5 ms·

Most of the issues are classified as Local privilege escalation, and none of the daemons mentioned are enabled by default, sshd can be enabled in the installer,

Most of the issues are classified as Local privilege escalation, and none of the daemons mentioned are enabled by default, sshd can be enabled in the installer, but as the quote says "sshd is not exploitable thanks to its defense-in-depth mechanisms." So, no. Still holds. Worth pointing that Linux has had a rough week as well, this one is pretty bad: https://www.openwall.com/lists/oss-security/2019/12/02/2 https://www.openwall.com/lists/oss-security/2019/12/02/2 Patch your systems.

naniwaduni 7y ago
Once again, the "in the default install" line should be read as "as long as you don't do anything interesting".
- juped 7y ago
  None of my OpenBSD machines (on which I do things) are remote-holed by this.
  - anthk 7y ago
    Neither are mines. PF blocks everything from the beginning, and no service is listening remotely. Heck, even for _outbound_ mail I have to create a rule for smtpd.conf. Half of the HN commenters do not know OpenBSD at all.
upofadown 7y ago
Smtpd (one of the mentioned daemons) is started in a default install. It is configured to do local mail delivery and can queue up remote deliveries for programs running on the system. It only connects to localhost and does not authenticate so this exploit would be irrelevant. If one did open an authenticated mail connection on an interface accessible to the world then the exploit would allow the system to be used as a spam relay. Added: Just to be clear, this doesn't give any significant access to the system itself through smtpd even if it is configured to be remotely accessible. So not a possible remote hole. Dunno about other stuff.
- notaplumber 7y ago
  Yes, correct. smtpd is enabled on localhost for local users only. This is pretty common on most systems, AFAIK Debain uses exim4.
  - deleted 7y ago
    [deleted]
- anthk 7y ago
  You need this line in PF at least: pass in on egress proto tcp from any to egress port smtp And maybe another one with submission instead of "smtp".
anthk 7y ago
Uh, a bug disclosed from the infamous FVWM guy with a great default config. This is amazing. http://taviso.decsystem.org/img/screenshot.png http://taviso.decsystem.org/img/screenshot.png
- aquabeagle 7y ago
  That you primarily know of Tavis from his FVWM config and not his security work is really weird.
  - anthk 7y ago
    Well, most people know Assange from politics and I knew him better from being the Surfraw author. To each its own, I suppose.
  - asveikau 7y ago
    I thought so too, but then I saw the screenshot, and it's a pretty nice looking fvwm setup.
    - anthk 7y ago
      It's one of the best FVWM setups ever. I am not trolling, he was cheered a lot back in the day, everyone adapted its config somehow.
      - asveikau 7y ago
        > back in the day, everyone adapted its config somehow. Yeah I know, although I don't remember coming across Tavis's config I did live through those heady days of customizing window managers and remember them with fondness. [Although that screenshot has emails dated 2006, which puts it well after that culture had peaked.] I actually started using fvwm2 again recently on one of my machines, I am not sure why, maybe I had some nostalgia for that time period.
        anthk 7y ago
technion 7y ago
This discussion comes up a lot, and I'd make an opposing case. Rather than debating whether OpenBSD can reasonably say this - I'd suggest most Linux distributions could say it themselves if they so wanted. Last time I installed CentOS the only port open on the firewall by default with OpenSSH after all.
- anthk 7y ago
  Also what a remote exploit could do against RH's sshd vs a hardened and pledged sshd under OpenBSD counts, too.
  - pnako 7y ago
    Red Hat's sshd is also hardened, and sandboxed using seccomp.
gerdesj 7y ago
Yes, patch as often as you can but I note that link you provide looks like a local priv. escalation, ie you have to be able to login to the box in some way. This OBSD bug is externally exploitable. Why did you single out an obscure Linux bug? There are quite a few other OSs available apart from OBSD.
- anthk 7y ago
  By default? No.
- notaplumber 7y ago
  It's a few threads above the OpenBSD one on oss-security, hardly obscure. https://www.openwall.com/lists/oss-security/2019/12/ https://www.openwall.com/lists/oss-security/2019/12/
satanspastaroll 7y ago
One could also say that this has been a great week for Linux, since all these problems have been caught

naniwaduni 7y ago

Once again, the "in the default install" line should be read as "as long as you don't do anything interesting".

juped 7y ago
None of my OpenBSD machines (on which I do things) are remote-holed by this.
- anthk 7y ago
  Neither are mines. PF blocks everything from the beginning, and no service is listening remotely. Heck, even for _outbound_ mail I have to create a rule for smtpd.conf. Half of the HN commenters do not know OpenBSD at all.

upofadown 7y ago

Smtpd (one of the mentioned daemons) is started in a default install. It is configured to do local mail delivery and can queue up remote deliveries for programs running on the system. It only connects to localhost and does not authenticate so this exploit would be irrelevant. If one did open an authenticated mail connection on an interface accessible to the world then the exploit would allow the system to be used as a spam relay. Added: Just to be clear, this doesn't give any significant access to the system itself through smtpd even if it is configured to be remotely accessible. So not a possible remote hole. Dunno about other stuff.

notaplumber 7y ago
Yes, correct. smtpd is enabled on localhost for local users only. This is pretty common on most systems, AFAIK Debain uses exim4.
- deleted 7y ago
  [deleted]
anthk 7y ago
You need this line in PF at least: pass in on egress proto tcp from any to egress port smtp And maybe another one with submission instead of "smtp".

anthk 7y ago

Uh, a bug disclosed from the infamous FVWM guy with a great default config. This is amazing. http://taviso.decsystem.org/img/screenshot.png http://taviso.decsystem.org/img/screenshot.png

aquabeagle 7y ago
That you primarily know of Tavis from his FVWM config and not his security work is really weird.
- anthk 7y ago
  Well, most people know Assange from politics and I knew him better from being the Surfraw author. To each its own, I suppose.
- asveikau 7y ago
  I thought so too, but then I saw the screenshot, and it's a pretty nice looking fvwm setup.
  - anthk 7y ago
    It's one of the best FVWM setups ever. I am not trolling, he was cheered a lot back in the day, everyone adapted its config somehow.
    - asveikau 7y ago
      > back in the day, everyone adapted its config somehow. Yeah I know, although I don't remember coming across Tavis's config I did live through those heady days of customizing window managers and remember them with fondness. [Although that screenshot has emails dated 2006, which puts it well after that culture had peaked.] I actually started using fvwm2 again recently on one of my machines, I am not sure why, maybe I had some nostalgia for that time period.
      - anthk 7y ago

technion 7y ago

This discussion comes up a lot, and I'd make an opposing case. Rather than debating whether OpenBSD can reasonably say this - I'd suggest most Linux distributions could say it themselves if they so wanted. Last time I installed CentOS the only port open on the firewall by default with OpenSSH after all.

anthk 7y ago
Also what a remote exploit could do against RH's sshd vs a hardened and pledged sshd under OpenBSD counts, too.
- pnako 7y ago
  Red Hat's sshd is also hardened, and sandboxed using seccomp.

gerdesj 7y ago

Yes, patch as often as you can but I note that link you provide looks like a local priv. escalation, ie you have to be able to login to the box in some way. This OBSD bug is externally exploitable. Why did you single out an obscure Linux bug? There are quite a few other OSs available apart from OBSD.

anthk 7y ago
By default? No.
notaplumber 7y ago
It's a few threads above the OpenBSD one on oss-security, hardly obscure. https://www.openwall.com/lists/oss-security/2019/12/ https://www.openwall.com/lists/oss-security/2019/12/

satanspastaroll 7y ago

One could also say that this has been a great week for Linux, since all these problems have been caught