From owner-freebsd-security@freebsd.org Wed Aug 10 08:50:40 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E1338BB01B2; Wed, 10 Aug 2016 08:50:40 +0000 (UTC) (envelope-from spankthespam@gmail.com) Received: from mail-qk0-x22f.google.com (mail-qk0-x22f.google.com [IPv6:2607:f8b0:400d:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 97FDF1431; Wed, 10 Aug 2016 08:50:40 +0000 (UTC) (envelope-from spankthespam@gmail.com) Received: by mail-qk0-x22f.google.com with SMTP id x185so36951936qkc.2; Wed, 10 Aug 2016 01:50:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=j8uNsspcPaCCV+nHSUHhc1Uxn+6s4/f5jDgOIwWtQLc=; b=zJbMTU7XV4Kz0LgRUJp1OMGtVlRmn8Cy+Wi+gM6DoBo7tSS/ySgKmEh3dWraD71wKz OXcXV8vaXIrNgcvmoZb8mV1E319qvEsl65uQvGzEPLVjj2ijsvRS4NVAQxP/GE4X6E6w B5wb40/0of7LBAKnhxA3PCPRo9pry0wigg07ppDmQMRtZCBDeku1ezgU1RvBWwZnUfaG ETyR8q5KDAu6xIuzf2yE9U8uCISFpgHhSWajMnxlLN8wZUTjsDrjkkeiWg5P00NO6E60 Hoe3U0PPbE3qabrCYXtK68FEE62xMRRjD6oEdWIS+NMH0UKbSvM7u2gkbxFG2tsBUP6z 0y/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=j8uNsspcPaCCV+nHSUHhc1Uxn+6s4/f5jDgOIwWtQLc=; b=UcoXixRcDb1J2A1G0LAMZWQpcS6SDNRBztlEpH1sP+tmyLtgDNG/GBotIn2SAD0+ie FraO9mitDFkOwbmOn5ilXWnH/UszYV2sXF/vFw1cNN1Qc0y1ThpudIHUs+2JCz7TqLwr eetnkPRFUH2rTuLw7OfvO8vKNMsR9FcGHmWbwI4s0lETOO7f7TFlDEuL5bBZFL/mAVo3 0uyzOJyzYSysOHIaRWKHFbYUsTv3D5tnAWAaDLwfGlxrucocET5k1ruh1+8adNSi6t8h khjilMSgWyqqrhA6kid9E2VmNUsjPiINvGR2DWnAgLDgmypR0PCcsbptEVa13b5B1CKd MWug== X-Gm-Message-State: AEkoousCxSdS5aaAT1TICQN47q5eU9Lp1bMldsr0kx2t8RngIpexpU8drL35wjwdIMKQI3b5kyl6gyeumZdHgg== X-Received: by 10.55.79.139 with SMTP id d133mr2756837qkb.99.1470819038340; Wed, 10 Aug 2016 01:50:38 -0700 (PDT) MIME-Version: 1.0 Received: by 10.200.49.71 with HTTP; Wed, 10 Aug 2016 01:50:37 -0700 (PDT) In-Reply-To: References: <6bd80e384e443e5de73fb951e973b221@vfemail.net> <8d52c11892db36d5041f7fa638e46681@vfemail.net> <57aa38bc.c505420a.7a6a0.bda8SMTPIN_ADDED_MISSING@mx.google.com> From: Big Lebowski Date: Wed, 10 Aug 2016 09:50:37 +0100 Message-ID: Subject: Re: freebsd-update and portsnap users still at risk of compromise To: Matthew Donovan Cc: Roger Marquis , freebsd-security , freebsd-ports , Martin Schroeder Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.22 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 08:50:41 -0000 On Tue, Aug 9, 2016 at 9:21 PM, Matthew Donovan wrote: > You mean operating system as distribution is a Linux term. There's not much > different between HARDENEDBSD and FreeBSD besides that HardenedBSD fixes > vulnerabilities and has a an excellent ASLR system compared to the proposed > one for FreeBSD. > And what are your sources on which you're formulating this statement? What is the HBSD authors security, or even general coding, track record? How well are they known for their code, whitepapers, implementations? I'd say, not at all. You can have the example of their 'ASLR' code quality in the FreeBSD reviews system, where known and respected coders point out very basic and critical code mistakes, where well known and respected system designers point out flaws in their lack of design, so on and so forth. The only thing that's excellent about them is how they spread this opinion about their code to other people, including you ;) I'd much rather take my bet with kib's implementation knowing who he is and how long and how well he does what he does (that is, quality code for FreeBSD) than untested, un-designed, self-procclaimed code from relatively young, inexperienced and unknown person, that's not willing to take advices on fixing their code, when given so. With all due respect :) > > On Aug 9, 2016 3:10 PM, "Roger Marquis" wrote: > > > Timely update via Hackernews: > > > > > y-update-libarchive> > > > > Note in particular: > > > > "FreeBSD is still vulnerable to the portsnap, freebsd-update, bspatch, > > and libarchive vulnerabilities." > > > > Not sure why the portsec team has not commented or published an advisory > > (possibly because the freebsd list spam filters are so bad that > > subscriptions are being blocked) but from where I sit it seems that > > those exposed should consider: > > > > cd /usr/ports > > svn{lite} co https://svn.FreeBSD.org/ports/head /usr/ports > > make index > > rm -rf /usr/sbin/portsnap /var/db/portsnap/* > > > > I'd also be interested in hearing from hardenedbsd users regarding the > > pros and cons of cutting over to that distribution. > > > > Roger > > > > > > > > On 2016-07-29 09:00, Julian Elischer wrote: > >> > >>> > >>> not sure if you've been contacted privately, but I believe the answer > is > >>> "we're working on it" > >>> > >> > >> My concerns are as follows: > >> > >> 1. This is already out there, and FreeBSD users haven't been alerted > that > >> they should avoid running freebsd-update/portsnap until the problems are > >> fixed. > >> > >> 2. There was no mention in the bspatch advisory that running > >> freebsd-update to "fix" bspatch would expose systems to MITM attackers > who > >> are apparently already in operation. > >> > >> 3. Strangely, the "fix" in the advisory is incomplete and still permits > >> heap corruption, even though a more complete fix is available. That's > >> what prompted my post. If FreeBSD learned of the problem from the same > >> source document we all did, which seems likely given the coincidental > >> timing of an advisory for a little-known utility a week or two after > that > >> source document appeared, then surely FreeBSD had the complete fix > >> available. > >> > >> _______________________________________________ > > freebsd-ports@freebsd.org mailing list > > https://lists.freebsd.org/mailman/listinfo/freebsd-ports > > To unsubscribe, send any mail to "freebsd-ports-unsubscribe@freebsd.org" > > > _______________________________________________ > freebsd-ports@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-ports > To unsubscribe, send any mail to "freebsd-ports-unsubscribe@freebsd.org" >