Students uncover dozens of Unix software flaws

TalkBack 50 of 71:

Next »

« Previous

• Thread View
• Flat View

So they found flaws in old applications.

There have been flaws found in the Linux kernel, which has been around since something like 1991 (and being improved), what flaws were found in the BSD systems? Application layer things (programs that one calls, such as

% nroff -man foo.8 | more
or
% man foo

This does not mean that the system is not reasonably secure. OpenBSD has been reasonably hardened, even had a DARPA grant for security research for a bit. Both Linux and FreeBSD now have RBAC (Role Based Access Controls), TE (type Enforcement) and MAC (Mandatory Access Controls) via the SE (Security Enhancements) from NSA. Solaris has RBAC as of 2.7 (Solaris 7) or so.

If all they found were application security problems that means that someone needs to learn to write more secure code. Most people don't do this, as it is not always very interesting to hunt for possible security exploits in a tool. Further, if you apply some of the security tools that I listed (which work out of the kernel), you can restrict the behavior of a program and constrain any dangerous behavior.

Alas, hunting through code for security exploits is not always that interesting for people to do. Secure code is also not always taht friendly to deal with (from a users perspective), there were only 3 OS's that met the old Rainbow Series A1 security level.

Posted by: B.O.F.H.   Posted on: 12/16/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Email Security and Archiving - Clearer in the Cloud Google The time is NOW for businesses and organizations of all sizes to implement ... Download Now
• Key Strategies for Federal Agencies - Safe and Cost Effective Migration for Legacy Hardware GovConnection The federal government has mandated that federal agencies reduce energy ... Download Now