10 ms·
OTOH, they would have been right if there had been (yet another) bug in openssl/whatever lib would be used for https. FWIW: 16 vulns in apt in NVD [0]; but 202
by moviuro 8y ago
OTOH, they would have been right if there had been (yet another) bug in openssl/whatever lib would be used for https.
FWIW: 16 vulns in apt in NVD [0]; but 202 for openssl [1]
[0] https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Adebian&cpe_product=cpe%3A%2F%3A%3Aapt https://nvd.nist.gov/vuln/search/results?form_type=Advanced&...
[1] https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Aopenssl&cpe_product=cpe%3A%2F%3A%3Aopenssl https://nvd.nist.gov/vuln/search/results?form_type=Advanced&...
- jwilk 8y agoHow many of these would result in RCE?
- dijit 8y ago64? https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=RCE&search_type=all&cpe_vendor=cpe%3A%2F%3Aopenssl&cpe_product=cpe%3A%2F%3A%3Aopenssl https://nvd.nist.gov/vuln/search/results?form_type=Advanced&...
- detaro 8y agoFulltext search for "rce", which finds "resou_rce_", "sou_rce_", does not give a number of RCE vulnerabilities.
- dijit 8y agoExcept that "EXACT MATCH" is enabled, try yourself. (It should be noted that it /does/ match on "possible RCE", which buffer overflows are often tagged with.)
- detaro 8y agoI have. Search for "ontgome" and it finds the bugs containing "Montgomery" (I have taken your url and just replaced the search word): https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=ontgome&search_type=all&cpe_vendor=cpe%3A%2F%3Aopenssl&cpe_product=cpe%3A%2F%3A%3Aopenssl https://nvd.nist.gov/vuln/search/results?form_type=Advanced&... I'm not saying none of the results from your search are RCEs, but not all are, and many are fairly speculative.
- dijit 8y agoArgh, that's frustrating, I checked 4 of them and thought it was fine. The problem is that there seem to be many classifications of remote code execution including buffer overflow and "code injection" and you can't choose multiple. :(
- detaro 8y agoYes, I also was surprised that the search didn't have more useful tools (e.g. search by high ranking in individual factors, or even just sort by severity: confirmed RCEs should all by very high)
- da_chicken 8y agoAs far as I can tell, NIST doesn't directly directly use the term RCE. CVE-2010-5298 is an OpenSSL vulnerability that allows data injection that could potentially result in code execution, but there's no easy way to see that from NIST's categorization: https://nvd.nist.gov/vuln/detail/CVE-2010-5298 https://nvd.nist.gov/vuln/detail/CVE-2010-5298
- detaro 8y agothat's an additional problem with relying on text search.
- ryanlol 8y agoHard to give an exact amount but there have been loads of potentially exploitable memory corruption issues.
- null_content 8y agoThat, and Debian would fuck up the implementation. Lest anyone forgets: https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number...
- raesene9 8y agoOpenSSL is not the only available implementation of SSL.
- detaro 8y agoRealistically, it's the one that's gonna be used in apt though. (E.g. the existing HTTPS transport uses curl, which uses OpenSSL)
- raesene9 8y agoSure, my point was more that if it's a serious concern to use OpenSSL (Personally I don't think it is, as a lot of work has been done in recent years to improve that codebase), that other options are available.
- jwilk 8y agolibcurl has many TLS backends. APT before 1.6 actually uses the GnuTLS one. APT ≥ 1.6 doesn't use libcurl; it uses GnuTLS directly.
- detaro 8y agoI stand corrected, thx.
- skywhopper 8y agoSo your argument is that bugs in OpenSSL (a necessarily very complex piece of software) mean that using SSL to increase network security is a bad thing?
- geofft 8y agoNo, their argument is that bugs in OpenSSL mean that using SSL when it does not actually increase network security is a bad thing. Reduce your attack surface. Use the things you need to use; don't use things you don't need to use. Whether apt using OpenSSL would in fact increase network security is a separate and debatable question, but the argument as stated assumes it would not, and is sound.
- zaarn 8y agoDefense in depth is a thing. SSL provides some security guarantees. Using signed package databases also provide some security guarantees. Both may overlap in what security they provide. BUT! If one fails, the other can continue to provide a subset of the previously available guarantees.
- moviuro 8y agoNot in the case of OpenSSL, no. (Some) OpenSSL issues, just as (some) apt issues, end with RCE. Game over. Priv-sep, correctly handling untrusted files (e.g. 1. check signature, then 2. execute whatever; not the other way round), memory-safe languages, etc. would be more welcome additions.
- Ajedi32 8y agoAPT already supports HTTPS. Enforcing it by default wouldn't increase APT's attack surface significantly.
- loeg 8y agoIt would decrease the number/quantity/capacity of available mirrors. I don't know if that quantity would be significant.
- Ajedi32 8y agoYou would lose the ability to do transparent caching which I agree is rather annoying, but I think most environments where that sort of caching occurs (mostly corporate and school networks) also have the means to explicitly configure client machines to use an internal caching mirror.