Students uncover dozens of Unix software flaws

Students of iconoclastic computer scientist Daniel Bernstein have found some 44 security flaws in various Unix applications, according to a list of advisories posted online.

The flaws, which range from minor slipups in rarely used applications to more serious vulnerabilities in software that ships with most versions of the Linux operating system, were found as part of Bernstein's graduate-level course at the University of Illinois at Chicago.

The advisories regarding the flaws were dated Wednesday and can be found on the Web site of student James Longstreet. Bernstein, a professor of computer science at the university, did not immediately respond to inquiries about the vulnerabilities.

The latest crop of security flaws comes two days after a software-testing company announced that it had found 985 flaws in the latest Linux kernel during the past four years using the company's analysis software. While the number seems high, the company said it is far lower than the number associated with most commercial software.

Each person in the class during the fall semester had to find 10 flaws, a task that counted toward 60 percent of their grade for the class, according to class notes posted on Bernstein's Web site. With only 44 flaws discovered among a reported 25 students, the students better hope for a generous curve.

Advertisement

Talkback 13 comments

    What the hell? This is tiled a ...Anonymous -- 17/12/04

    What the hell? This is tiled and written in a manner to paint Open Source with perverbal egg on the face. Based on recent news.

    Even as it references the very preceeding reports of Linux/Open Source with execllent and superior quality, security and even truly lower cost (contrasting MS words).

    Sure, the students finding the bugs is interesting and the article does suggest it was tough for them to make the grade finding Open Source bugs but it is sorely lacking in this current climate of confusion, Microsoft on the war path and plan ole FUD (Fear, Uncertainty & Doubt).

    It is poor reporting in my view. Don't leave out the details such as most people don't understand the Open Source concept yet. This even though it's proved to work. People think Open Source is or can be nothing more than inferior. They are not aware of cutting edge select choices such as MEPIS. http://www.mepis.com

    The old Linux is dead.

    Most people are invested (AKA trapped) in a Windows world (and this is changing fast) and they aren't (largely) aware yet that the alternative is better. I wouldn't have said that last year but overall Mepis is truly better. It's ALL about which "distribution " one chooses (to each his own) but please try mepis v2004.4 or newer first (AKA SimplyMEPIS).

    You can get mepis at LinuxCD for $3.89 USD! That's for burning and shipping to your door (no gas required)! Read http://www.mepis.com to see why.

    With this many full features and (new) ease of use please don't forget this is why NOW is a good time to migrate (you do *NOT* have to erase Windows). Now is the time because who knows how much better Linux will be next year; at this pace. A pace that no closed vendor can match!

    Set the OS free and let it be Open and not closed for the users of the world. Just try it now and keep your money for hardware.

    At LEAST and to start, download and run (for free) Firefox and Open Office for Windows.

    This is the path people and it's no longer difficult to follow. Join the Linux ease of use movement. If you are not technical (and that's OK) , just ask for help and you are sure to find a Linux friend that will install it for you. By the way; given a partition, Mepis can be installed in about 20 minutes with it's easy installer but just pop it it the CD drive and boot it LIVE (2 minutes) to watch it automagically detect and install all your hardware. If you like it use it. If you don't then remove the CD and your done. Now how much risk is $3.89 (US) and 2 minutes?

    News flash: Yet another linux ...Anonymous -- 17/12/04

    News flash: Yet another linux fanatic is up in arms over an article which could possibly be interpreted as painting linux in a negative light.

    Why does every open source and ...Anonymous -- 17/12/04

    Why does every open source and Linux nutcase think that people are enslaved into paying money to already rich Microsoft ? For heavens sake, people spend more money on cheeseburgers, movie tickets, prostitutes and they would probably spend on software.

    I like Windows software and I like open source software. But I cant stand and form of FUD machines - yes even the ones that come from open source zealots.

    'Students uncover dozens of Li ...Anonymous -- 17/12/04

    'Students uncover dozens of Linux software flaws'

    Why does every Microsoft sycop ...Anonymous -- 17/12/04

    Why does every Microsoft sycophant slur Linux users by calling them nutcases?

    Merry Christmas y'all ;-)

    All I can say is "Typical ...Anonymous -- 17/12/04

    All I can say is "Typical".

    And for those of you who belive the "alernative" is "better", wake up to yourselves. Like really. If you're going to be that pathetic, go out and buy an Apple Mac or something.

    Jason Green. Maybe think about ...Anonymous -- 17/12/04

    Jason Green.

    Maybe think about this for a moment.

    1) These flaws can be found by interested 3rd parties _because_ it is open source code.

    2) This means that these holes can be fixed _before_ they become a security issue.

    3) Even without access to source code, crackers find and exploit _more_ holes in Microsoft code. Except no one can find and fix these holes except for Microsoft.

    4) This means that everyone is at Microsoft's mercy.

    5) And some users, paying users, like WinNT users, are stuck with no updates any more.

    It would help the Windows camp considerably if you actually responded with meaningful posts here rather than just vomited neurotic verbiage like the Linux loudmouths. We know they are 15 year old weenies. There's no point you showing yourself up at their level.

    Michael. Wakey wakey. These co ...Anonymous -- 17/12/04

    Michael.

    Wakey wakey.

    These coding errors were found in application stack apps. These are the _SAME_ ones which do and can run on the open source BSD/Mach based OS X kernel.

    What exactly don't you understand?

    Very ho ho ho hum! (and Season ...Anonymous -- 17/12/04

    Very ho ho ho hum! (and Seasons greetings too).

    The list of exploits shows mostly bits and pieces that would never be running on a bastion host, and perhaps occasionally in normal cir****stances.

    No doubt some form of exploit could be crafted around these, but I expect the zealots will snuff them all out now they are in the open.

    Seems like DJB p****ed the students even tho they didn't make the grade!

    The Dude: I don't know why yo ...Anonymous -- 17/12/04

    The Dude: I don't know why you find it neccesary to target me, based on my post, but i'll bite...

    >1) These flaws can be found by interested 3rd
    >parties _because_ it is open source code.

    This is quite obvious... What's the point. Maybe you should consider the fact that open source also allows crackers to find vulnerabilities more easily also.

    >2) This means that these holes can be fixed
    >_before_ they become a security issue.

    Well, this of course depends on who found the vulnerability and their personal feelings on disclosure.

    >3) Even without access to source code, crackers
    >find and exploit _more_ holes in Microsoft code.
    >Except no one can find and fix these holes
    >except for Microsoft.

    Personally, I don't have a problem with this. I use MS development tools on a regular basis and have experimented with some of the vulnerability detection software that they use and have the utmost faith in their ability. Of course, having a market share an order of magniture higher than Linux also means that there are many, many more people trying to discover and use vulnerabilities for their own nefarious purposes.

    >4) This means that everyone is at Microsoft's
    >mercy.

    The majority of desktop users (which is Windows' primary market) have no technical knowledge or ability to understand this code in the first place, so the only people who think they are "at microsoft's mercy" are the technical users who hate Microsoft. Most people CHOOSE to use windows.

    >5) And some users, paying users, like WinNT
    >users, are stuck with no updates any more.

    Nowhere in the business world does a manufacturer support a product indefinitely. In technology terms, Windows NT has had an exceptionally long life.

    >It would help the Windows camp considerably if
    >you actually responded with meaningful posts
    >here rather than just vomited neurotic verbiage
    >like the Linux loudmouths. We know they are 15
    >year old weenies. There's no point you showing
    >yourself up at their level

    Oh you would be surprised at the age of some of these Linux Loudmouths. I find it quite amusing that you've responded with an attack on a post that I've made, which was very specifically targeted at a person you describe as "15 year old weenies". You might be surprised to know that I use Linux on a daily basis and have developed for both operating systems... It ruffles my feathers when these Linux Loudmouthes, that you describe, start spouting garbage and introducing rediculous conspiracy theories when anybody says anything positive about Windows, or negative about Linux (or any other open source product).

    Very ho ho ho hum! (and Season ...Anonymous -- 17/12/04

    Very ho ho ho hum! (and Seasons greetings too).

    The list of exploits shows mostly bits and pieces that would never be running on a bastion host, and perhaps occasionally in normal cir****stances.

    No doubt some form of exploit could be crafted around these, but I expect the zealots will snuff them all out now they are in the open.

    Seems like DJB p****ed the students even tho they didn't make the grade!

    Gosh, so the computing Holy Gr ...Anonymous -- 17/12/04

    Gosh, so the computing Holy Grail doesn't exist yet.
    I'm just so surprised ...
    No platform is perfect. Get over it.

    I must congratulate the Linux ...Anonymous -- 19/12/04

    I must congratulate the Linux community on its restraint in response to this article (except the first poster, who appears to think it is the job of journalists to advertise Linux in their editorials).

    Perhaps they've realised that actions speak louder than words, and far better than writing pointless feedback attacking Microsoft would be to fix the flaws in a matter of days or weeks - instead of the months which is often taken by Microsoft - and thus prove open source is the better system.

Add your opinion

Latest Videos

Sponsored content

Power Centre - Content from our premier sponsors

Blogs

  • David Braue All I want for Xmas is Telstra pricing
    Five consecutive days without broadband has led me to what seemed at the time to be an act of desperation: contemplating signing up for Telstra's 100Mbps cable modem service.
  • Array Sick of broken tender sites
    Some of the state governments desperately need to invest in more user-friendly tender sites so that looking for information on government tenders doesn't have to be a game of blind man's bluff.
  • Array Cyberwar: What is it good for?
    In this week's episode, Cyberwar. What is Australia's place in the world of digital warfare? What are the implications for the NBN?
  • More blogs »

Tags

Back to top

Featured