Fixing the flaws in Microsoft's big picture

TalkBack 35 of 46:

Next »

« Previous

• Thread View
• Flat View

Stop spreading the FUD

Dear Linux zealots:

I know how you love to take this opportunity to tell the world how Bill Gates is the minion of Satan and Linux is perfect. I'm asking you to be truthful. Linux, like all software, has flaws. It is not perfect. The flaws don't get much coverage because, now let's be honest, the flaws don't affect as many people as a Microsoft flaw.

Too many of you like to take every opportunity to show how Microsoft is doomed and Linux is perfect. I'll now take this time to point out CURRENT flaws with some of the Linux distros:

Fedora Update Notification
FEDORA-2004-116
2004-07-01
Product : Fedora Core 1
Name : rsync
Version : 2.5.7
Release : 5.fc1
Summary : A program for synchronizing files over a network.
Rsync before 2.6.1 does not properly sanitize paths when running a
read/write daemon without using chroot. This could allow a remote attacker
to write files outside of the module's "path", depending on the privileges
assigned to the rsync daemon. Users not running an rsync daemon, running a
read-only daemon, or running a chrooted daemon are not affected by this
issue.

Fedora Update Notification
FEDORA-2004-168
2004-07-01
Product : Fedora Core 2
Name : mailman
Version : 2.1.5
Release : 7
Summary : Mailing list manager with built in Web access.
Mailman subscriber passwords could be retrieved by a remote attacker.


Fedora Update Notification
FEDORA-2004-205
2004-07-02
Product : Fedora Core 2
Name : kernel
Version : 2.6.6
Release : 1.435.2.3
Summary : The Linux kernel (the core of the Linux operating system)
During an audit of the Linux kernel, SUSE discovered a flaw in the
Linux kernel that inappropriately allows an unprivileged user to
change the group ID of a file to his/her own group ID.


FreeBSD-SA-04:13.linux Security Advisory
The FreeBSD Project

Topic: Linux binary compatibility mode input validation error

Category: core
Module: kernel
Announced: 2004-06-30
Credits: Tim Robbins
Affects: All 4.x and 5.x releases
II. Problem Description

A programming error in the handling of some Linux system calls may
result in memory locations being accessed without proper validation.

III. Impact

It may be possible for a local attacker to read and/or overwrite
portions of kernel memory, resulting in disclosure of sensitive
information or potential privilege escalation. A local attacker can
cause a system panic.

Mandrakelinux Security Update Advisory
_______________________________________________________________________

Package name: apache
Advisory ID: MDKSA-2004:065
Date: June 29th, 2004

Affected versions: 10.0, 9.1, 9.2, Corporate Server 2.1
______________________________________________________________________

Problem Description:

A buffer overflow vulnerability was found by George Guninski in
Apache's mod_proxy module, which can be exploited by a remote user
to potentially execute arbitrary code with the privileges of an
httpd child process (user apache).

Mandrakelinux Security Update Advisory
_______________________________________________________________________

Package name: apache2
Advisory ID: MDKSA-2004:064
Date: June 29th, 2004

Affected versions: 10.0, 9.1, 9.2
______________________________________________________________________

Problem Description:

A Denial of Service (Dos) condition was discovered in Apache 2.x by
George Guninski. Exploiting this can lead to httpd consuming an
arbitrary amount of memory. On 64bit systems with more than 4GB of
virtual memory, this may also lead to a heap-based overflow.

I could go on, but I think you get the point. Linux is not perfect. Microsoft isn't either. Get off your high horse, stop spreading your FUD, and get back to work. As IT professionals it should be important that we all understand what we are doing. It does none of us any good to make our projects look indestructable when we ALL know that given the motivation, any software can be broken.

We ALL must teach the consumers of our efforts that given time, software and hardware will fail. We should continue to educate them that because everything can and will fail, that it is important that they keep us around because we know how to fix these issues.

So please, do us all a favor, stop the cheerleading. They same goes for the Microsoft zealots.

Posted by: dj_45_cal   Posted on: 07/08/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now
• Get top-ranked Novell support for Red Hat at 50% less Novell A simplified IT environment isn't just less complex, it's more reliable. ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now