News for hackers. Stuff that matters.

A comment on Critical crypto bug leaves Linux, hundreds of apps open to eavesdropping. Parent comment

Re: Critical crypto bug leaves Linux, hundreds of apps open ... by cperciva on Tuesday March 04, 2014 @04:44PM (#7343408)
That's a signal of how much attention GnuTLS gets.

It's a signal of how much attention the dark and dusty corners of all open source code gets. My "favourite" FreeBSD advisory was the 2011 telnetd "christmas present" -- remote root to any system running telnetd with the default options. The bug was in routines for setting up encrypted telnet sessions... who even knew that telnet had encryption? The bug was a blindingly obvious buffer overflow, but nobody goes digging through telnetd looking for encryption code.

About six months after that advisory, I heard from a major aircraft manufacturer that they had been using the BSD telnetd code to provide a channel for in-flight tuning of engine performance.

This is why I award bug bounties for punctuation errors in comments in the Tarsnap source code -- it encourages people to read all the code, not just the interesting bits.

[ Parent | on HN ]
Re: Critical crypto bug leaves Linux, hundreds of apps open ... by einhverfr on Tuesday March 04, 2014 @10:10PM (#7345012)
> who even knew that telnet had encryption?

I did. Most of the ftp, telnet, rsh, etc. utilities shipped with BSD and Linux had Kerberos and encryption support. I also suspect that these had at least wider use in larger environments than many people knew, because before OpenSSH had Kerberos support, you could integrate encryption and authentication in useful ways.

[ Parent | on HN ]
Re: Critical crypto bug leaves Linux, hundreds of apps open ... by cperciva on Wednesday March 05, 2014 @04:51AM (#7346185)
Oh, I'm not talking about the Kerberized telnet. I'm talking vanilla BSD telnet.
[ Parent | on HN ]
Re: Critical crypto bug leaves Linux, hundreds of apps open ... by einhverfr on Wednesday March 05, 2014 @07:11PM (#7350924)
But even there I think you are talking about "oh you can do that with kerberos which not everyone has so let's add it for other environments too."

The problem with encrypted telnet has always been handling of cases where encryption isn't supported.

[ Parent | on HN ]
Re: Critical crypto bug leaves Linux, hundreds of apps open ... by sigzero on Tuesday March 04, 2014 @06:18PM (#7343945)
I believe the bug was actually reported but not fixed:

http://www.openldap.org/lists/openldap-devel/200802/msg00072...

[ Parent | on HN ]
Re: Critical crypto bug leaves Linux, hundreds of apps open ... by tokenrove on Tuesday March 04, 2014 @09:17PM (#7344826)
All of Howard Chu's analysis in that thread is great, but he didn't discover or report this bug. Reading that message should make it clear; he's talking about sloppy string handling and bad APIs, neither of which has anything to do with this bug, which was mixed-up return code semantics in an internal, static function. Look later in that thread for some other pretty sloppy code he tears apart, though.
[ Parent | on HN ]
Re: Critical crypto bug leaves Linux, hundreds of apps open ... by hyc_symas on Thursday March 06, 2014 @12:26PM (#7355130)
The point is that the GnuTLS code quality was obviously crap, the developers were obviously incompetent, and only a fool would trust GnuTLS with their system security. I pointed out numerous problems - more in private emails to the GnuTLS authors and Debian maintainers, not just those published on the list - all related to the sloppy programming practices and inconsistent APIs. This mixed-up return code semantics is just another consequence of those sloppy programming practices. How many ways do you have to see that "this software sucks and the developers don't know WTF they're doing" before you realize you shouldn't be trusting them?
[ Parent | on HN ]