NetBSD vulnerabilities Sep 17, lotsa...

unSpawn · 09-17-2002, 03:47 PM

Those of you running Net' will want to look here if you didn't already: LAW.

elmore · 09-17-2002, 08:55 PM

These CERTS look particularly nasty, I'd hate to have a public NetBSD box right now. Hmmmm, I hope these don;t spill over into OpenBSD, there's still a lot of shared code between the two. That could spell disaster.

supenguin · 09-24-2002, 02:54 PM

If you read the release notes for NetBSD 1.6, most of these vulnerabilities (maybe with the exception of 1) are fixed in 1.6. I wish other software vendors were like that about fixing bugs. "Hey, we found this bug in our software, but pgrade to the latest. Its fixed already!"

MobyTurbo · 10-14-2002, 02:31 PM

An update on this issue, some additional vulnerabilities have been just recently published that apply to 1.6. Most of them are not severe, however, since NetBSD defaults to having all services off. (Unlike most *nix, even openssh defaults to being off, though that is not one of the vulnerabilities this time. :-) ) Even OpenBSD boasts to having only one default setup in 6 years with a remote vunerability, not "all programs of OpenBSD". NetBSD's default setup is similarly safe, allowing the competant admin to install a release, update the system, and deploy without worrying about his box being rooted between installation and finding any security bugs that might exist.

NetBSD is actually a very secure operating system. The fact that they find vulnerabilities every now and then and publish them is a result of paying attention to security issues, not a result of the failed "security through obscurity" policy of many closed-source operating systems. NetBSD also warns you if you install a third party package with known vunerabilities. (I think the other BSDs do this too. FreeBSD does.)

supenguin · 10-15-2002, 01:52 PM

Thanks for the info. I have been impressed with way the BSDs handle security issues, and was just wanting to know if all known issues in 1.6 were fixed. It seems that all known security issues were fixed when 1.6 came out, but a couple more have been discovered since then. I guess we can look forward to a few security patches and 1.6.1 in the near future.

markus1982 · 10-15-2002, 03:59 PM

There are and will always be insecure pieces of software cause the people developing software are just humans. Humans make mistakes ... code audits are nice but take up a lot of ressources!