12 ms·
Outdated, vulnerable open source components shipped with Windows 10 and 11
- albertopv 5y agoFew weeks I had to run a simple curl command, it did not work with Windows 10 21H1 native curl, but it did from WSL2 Ubuntu. First and last time I tried it.
- yabones 5y agoWhile it's not good to ship outdated client libraries & software, it would be much worse to distribute an old OpenSSH release... Can anybody with a Windows 10/11 box check the version they supply? That, to me, would be a much more serious problem.
- deleted 5y ago[deleted]
- joenathanone 5y agoSSH -V on Windows 11 returns >OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2
- JDW1023 5y agoAccording to https://www.libressl.org/releases.html https://www.libressl.org/releases.html, LibreSSL 3.0.2 was released on October 19th, 2019. So it's exactly two years out of date. edit: on my windows 10 21H1, the timestamp in COFF/File header for ssh.exe shows '1584509394' (Wed, 18 Mar 2020 05:29:54 UTC).
- 1over137 5y agoThat LibreSSL is newer than even the latest macOS 12 Monterey beta: OpenSSH_8.6p1, LibreSSL 2.8.3
- pseudosavant 5y agoYeah, but nobody has fun hating on Mac any more right? Thanks for the context.
- eftychis 5y agoWell people (including me) are bashing Apple for this deviation. Also it has been a constant consideration when linking/shipping binaries in production. So I feel it is fine to bash Microsoft for doing the same thing. Perhaps Microsoft has an ABI reason for doing so? I can't imagine why else.
- gjsman-1000 5y agoPerhaps - but Apple has used very old core utilities for a very long time (licensing issues) but ensures they get security updates. Until recently, they used, what, bash from 2006?
- 1over137 5y agoThere's no licensing issue with LibreSSL, nor any of the other ancient utilities from FreeBSD or elsewhere that Apple doesn't keep up-to-date.
- bombcar 5y agoIf the old version has known security flaws it should be possible to exploit them, correct? If those exploits don’t work perhaps Apple is playing dolly nuggets with the version number.
- arp242 5y agoNah, there are all sorts of missing features, some of which were added over a decade ago. With a few small exceptions and modifications much of the Unix base has been quite dead for a long time.
- neodymiumphish 5y agoOdd, I'm on the Dev insider build (22478.1012) and I see > OpenSSH_for_Windows_8.6p1, LibreSSL 3.3.3
- Semaphor 5y agoGetting the same for win 10 20H2 (Build 19042.1288)
- dachryn 5y agoSSH --V on Windows 10 returns OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5
- jve 5y agoMine Win10 returns: OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2 where.exe ssh.exe C:\Windows\System32\OpenSSH\ssh.exe systeminfo.exe | sls "OS V" OS Version: 10.0.19043 N/A Build 19043
- tarnith 5y agoSame on Win 10 21H1 19043.1288 ssh -V OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2
- e12e 5y agoSame for the daemon? (yes, windows comes with (installable) ssh daemon now).
- Factorium 5y agoWindows should just become a Linux Distro already.
- deleted 5y ago[deleted]
- jchw 5y agoIt already has the Linux kernel, a Wayland compositor, PTYs, symlinks, POSIX compliant filesystem and now a package manager. Clearly, they are interested in moving the gap. Jokes aside, I don’t really think it’s a possibility in the near or mid future, but if Microsoft ever did show signs of pivoting towards a Linux-based Windows successor, I only pray that the NT kernel source code may be open sourced under a decently liberal license. No matter how late in time that move occurs, it will still be a boon for preserving an entire era of computing.
- deleted 5y ago[deleted]
- Datagenerator 5y agoIt will never be fully open. They got all of the three letter agencies to cooperate with... that's why they want to stay on the CPU as primary OS next to Unix on the secondary processor Intel provides called Active Management Technology (AMT). This hardware and firmware for remote out-of-band management is running the Intel Management Engine, a separate microprocessor not exposed to the user, in order to monitor, maintain, update, upgrade, and repair them using mesh networks.
- peakaboo 5y agoAnd with windows 11 requiring certain processors, I'm pretty sure Intel built something even more interesting into those ones which will make AMT look like childsplay.
- pessimizer 5y ago> It will never be fully open. They could just become a BSD, like Apple did. Nothing they're doing with linux wouldn't work with some future Microsoft BSD that kept backwards Windows compatibility as a Wine-type shell. They do that, they can close up whatever they want, just like Apple.
- FounderBurr 5y agoNo commercial vendor is going to ship bleeding edge code with a promise to support it.
- alpb 5y agoThey don't have obligation to ship bleeding edge off-the-shelf code but they do have an obligation to provide the operating system with security patches. If the user clicks on a tar file to extract it and it ends up writing to random places on their filesystem due to a vulnerability, that is gonna be a problem for the enterprise users.
- thrower123 5y agoFortunately Windows won't extract tar files out of the box.
- tinus_hn 5y agoHaha as if that doesn’t happen all the time. Enterprise says ‘well nothing is truly secure’ and just installs the update after a month.
- Wowfunhappy 5y agoThey should patch whatever vulnerabilities exist in whatever version of the component they've decided to ship. That's the point of it being open source.
- stusmall 5y agoFrom the post I'm not positive that they aren't. The release date and patch date in that version string are different. They might be cherry picking individual patches back to an out of tree branch and haven't had anything since 11-19 that met their threshold for cherry picking. I'd be interested in which have these 15 CVEs are actually exploitable and their CVSS are before I jump to conclusions from just a version string.
- jodrellblank 5y ago
- timsutton 5y agoHave you met OS X?
- tclancy 5y agoWhataboutism without data smells like FUD.
- deathanatos 5y agoUh, it's pretty well-known that Apple ships some absolutely ancient stuff in macOS. It can't be that hard to find a reference… but, here ya go: » curl --version curl 7.64.1 (x86_64-apple-darwin20.0) libcurl/7.64.1 (securetransport) libressl/2.8.3 zlib/1.2.11 nghttp2/1.41.0 release-date: 2019-03-27 protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp features: asynchdns gss-api http2 https-proxy ipv6 kerberos largefile libz multissl ntlm ntlm_wb spnego ssl unixsockets » bash --version gnu bash, version 3.2.57(1)-release (x86_64-apple-darwin20) copyright (c) 2007 free software foundation, inc. So unless Apple has some patches on top of that, as curl's website says, there are 22 vulns. in that 2.5 yo version.[1] That version of bash is from about when the copyright indicates, i.e., 14 years ago. Thankfully there probably isn't a good exploit path for bash that doesn't already involve one being able to run code, but still, as a dev, it'd be nice to get a more recent version. [1]: https://curl.se/docs/releases.html https://curl.se/docs/releases.html
- sbuk 5y agoSubsequent versions of bash are GPLv3 “encumbered”. Apple as an organisation have decided that the best way to avoid potential licensing issues with GPLv3 is to avoid GPLv3, which appears to be part of the intent of GPLv3. Tell me, who is hurting consumers of software? I will accept that Apple is partly to blame - they could be, and should be more open and perhaps contribute more, or at least follow Google’s lead and use it as marketing. But the GPLv3 is a burdensome license that even the star of the movement has rejected. That is holding back OSS as much as anything else. Making it commercially hard to use the software isn’t helping adoption or contributions.
- bombcar 5y agoWait until people see how old the components RedHat ships.
- christophilus 5y agoAt least RedHat backports security patches.
- elagost 5y agoIt's important to understand that you can't go by major version numbers in most fixed-release, long term support Linux Operating Systems, like RHEL, Debian, or Ubuntu. There is often deeper investigation needed. https://access.redhat.com/security/updates/backporting https://access.redhat.com/security/updates/backporting https://www.redhat.com/en/blog/what-backporting-and-how-does-it-apply-rhel-and-other-red-hat-products https://www.redhat.com/en/blog/what-backporting-and-how-does...
- pmorici 5y agoLost count of how many times I’ve had to fix software that checked kernel version numbers instead of wether a particular symbol exists. It often breaks when compiled on Redhat because they backport so many patches to old kernel versions.
- tlamponi 5y agoOlder releases aren't the problem as long as they're maintained, which RH devs are good doing so. Taking a 4+ year old release and not applying any patches even if upstream did their due diligence with informing users about a lot of fixed stuff and then shipping that by default is rather unacceptable by the OS distro vendor though.
- sjellis 5y agoRed Hat's business model is that they ship a defined set of components and patch those components as needed for years without breaking compatibility. Red Hat explicitly will not ship a component unless they can build it from source and update it, and have confidence that they can continue to do so for the life of the OS version. That's what being a responsible "enterprise" operating system vendor means.
- annoyingnoob 5y agoI read the rant. What, exactly, is the impact to the average Windows user?
- tenryuu 5y agodefine the average windows user. then how much of the windows market does that exclude
- annoyingnoob 5y agoAnother way to look at it is, how hard is the issue to exploit and what are the impacts? Does exploitation require local admin access? My point really was that the write up is mostly a rant and provides nothing to help anyone that is impacted. Seems more about poking Microsoft than solving security issues.
- noxer 5y agoNone, and anyone who cares could replace the files with a newer version its not like MS would make it hard to do that.
- gigel82 5y agoLikely done by an eager intern back then as a binary drop and never properly integrated into whatever build system Windows uses. Nevertheless, as a consumer, I appreciate having curl in-box (no matter how out-of-date). Came in handy when I wanted to firewall the heck out of Windows 11 and strip out every unwanted component (including the only browser, Edge). Of course, later found out that curl.exe complains about ssl certificates if you firewall / block whatever Windows service does certificate validation, but luckily PowerShell has a built-in wget command as well for downloading which doesn't seem to care as much :)
- jagged-chisel 5y agoThere’s an option for curl to ignore cert validation
- gigel82 5y agoTried that first, apparently only works with OpenSSL and the Windows binary is linked to some OS SSL library instead.
- jve 5y agoProbably SCHANNEL then. OS must reach out crl.microsoft.com for CRL checks. https://social.technet.microsoft.com/wiki/contents/articles/2303.understanding-access-to-microsoft-certificate-revocation-list.aspx https://social.technet.microsoft.com/wiki/contents/articles/...
- gigel82 5y agoYes, that's the one. I wanted to start with a fully firewalled system and explicitly allow URLs as I go along. I needed to eventually allow that one through to get to a functional state (with Windows Update and MS Store running).
- mynameismon 5y agoWell, if you really want to strip all unwanted components, take a look at WinGet. Everything (by everything, I mean everything) is just a winget uninstall away
- 1970-01-01 5y agoYou can actually see how MS is ignoring this screw-up. The update problem was posted directly to the devteam's blog in 2019: https://devblogs.microsoft.com/commandline/tar-and-curl-come-to-windows/#comments https://devblogs.microsoft.com/commandline/tar-and-curl-come... https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/bc-p/1604550/highlight/true#M105 https://techcommunity.microsoft.com/t5/containers/tar-and-cu...
- known 5y agoMicrosoft is 'infected' with https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...
- ocdtrekkie 5y agoThis is what's really annoying about the new Windows team. They often are so obsessed with doing new cool things to win back users, they often fail where Microsoft has traditionally proven superior: Careful, well-planned steps that maintain the utmost security and process. WinGet, for example, was entirely automated approval for changes to app installs. It took so much time to convince them was easy to compromise, and then they implemented some community moderators instead of hiring an app review team.
- pjmlp 5y agoKilling C++/CX and replacing it with a developer experience akin to using VC++ 6.0 with ATL 3.0, or leave .NET Native to roten, is hardly the way to win back users.
- Woodi 5y agoSeclist post looks pretty clear and simple - pleas everybody send a link to it to your government representative person :> And to management too ! Let them have on paper what they opt for :>
- saasaccount2 5y agoSome time ago, Microsoft announced that they would be working to integrate Windows and Linux so as to provide users with a better operating system experience and greater functionality.They should fix whatever vulnerabilities with whichever version of the server-side software they've decided to integrate.