OpenBSD security flaw

Ahhh moments like this. After hearing "OpenBSD is the most secure OS in the world" like 90 times in the past week, I get this in my inbox:

______________________________________________________________________________________________________________________
Georgi Guninski posted an advisory on his site about a remote crash in
the OpenBSD kernel caused by connecting with a small IPv6 MTU.

http://www.guninski.com/obsdmtu.html

The error was present in revision 1.81 of /src/sys/netinet6/ip6_output.c
and is fixed in revision 1.82 ( 2004/02/04 08:47:41 ), you can see the
colored diffs at

http://www.openbsd.org/cgi-bin/cvswe..._output.c.diff
?r1=text&tr1=1.81&r2=text&tr2=1.82&f=h


OpenBSD administrators should pull the revised code from CVS and
recompile their kernels.




Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
http://www.pivx.com
[email protected]
Phone: +1 (949) 231-8496
PGP: 0x5A276569
6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569

PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
Qwik-Fix
<http://www.qwik-fix.net>

______________________________________________________________________________________________________________________

:)

OpenBSD changed their page to say

Quote:

---

Only one remote hole in the default install, in more than 7 years!

---

Cheers,
cgkanchi

Guninski's hole is a new one I think, so they may need to changed that to "only two remote holes in the default install"

Uhh... I think the one remote hole is a reference to Gunski's hole, not to a previous one. This is the only one I've ever heard of, remote or local.

I thought the first hole was an OpenSSH related exploit that appeared in 2002?(As OpenSSH is in the default installtion of OpenBSD I believe). This one is a new IPv6 hole

There are some other exploits out there for it as well, but they seem to get around them by using that "default install" line.

Quote:

---

I thought the first hole was an OpenSSH related exploit that appeared in 2002

---

That would be a flaw in OpenSSH rather than OpenBSD and that particular flaw, IIRC, affected all OSes that had/used OpenSSH. This one seems specific to the OpenBSD itself.

The "one remote hole" is indeed the OpenSSH one. That score referes to OpenBSD's default install, so OpenSSH is/was fare game.

The new bug isn't considered a hole because it can't be exploited (give shell), it only crashes the box, as far as we know for now.

Ammo

Opeb BSD is nice. There is no doubt in that. But Some people take it a bit extreme at times thinking it's un hackable. No OS is like that. It's still all code waiting to crack exploited. I do like the idea of the code audits, and I think that is a reason that it has become so secure.

Did you guys know Linux was the first OS (and perhaps it still is) the first/only OS to have a completely RFC compliant IPv4 stack? Linux's IP stack is still regarded as one of the best around.

I posted the web site I found this on in the OS forum. It's located here:

http://digital-domain.net/lug/unix-linux-history.html

When compared to the track record of other OS's, OpenBSD still holds the champions belt. I think 1 remotely exploitable bug and one remote DoS bug in seven years is a record I can live with (Especially given some of the competitions record). Since OpenBSD isnt used near as much as other OS's its hard to get a real accurate statistical depiction of where they fit in in the security scale, but overall there are alot of details I appreciate about the OS, for instance the IP sequence (PRNG) for OpenBSD and Linux kicks the **** out of other OS's and thats just one of many security conscious features BSD employs. No one ever said programmers didnt make mistakes, but its nice when they at least look for them BEFORE they distribute their software. (*ahem* Microsoft *ahem*) :)

-Maestr0

Funny you should bring up Microsofts development ways. Last night in my Linux + class, a guy that had worked doing some things for Microsoft was recounting some of the horror he had seen at Windows camp. It surely made Camp crystal lake seem like a dream, at least Jason didn't have software bugs ;)

He said while he was there, that it was the time when office 97' was being released. They had Office 97' and Office 2,000 not only finished, but, instead of being like BSD and checking for bugs BEFORE releasing, that they released it and let other people find the bugs.

Then when all of those bugs were found, they applied them to office 2,000 and released it whenever that dark day was they released it. I can hardly believe a company with that kinf od cash power would do something like this. If my company was like them....Well, there isn't much hope for them left, but they are at least starting to try.

But if I had that kind of money, I would be hiring hackers 24/7 to come in, and try their best to crack the software. That damned registration would be out the window. They have things about registration where useability is taken away so that peopl can't pirate it as easy.

I'd stop that. The new office, is nice. But the price tag on it......I could get a new computer for that price, and download Vi and Emacs. I only use word when I HAVE to do a project for school. I got Office XP Pro when it came out for $200.00 from my school. I use word, that's about it. I can do everything I need to though, in Vi. It sucks when schools are almost forced into using that because it's what alot of businesses use.

When start my company in a few years, you'll MAYBE see ONE copy of office lying around. Other than that, we will be using Vi and Emacs. I need to learn C better than I do. I'll code my own office suite. And give it away free with my OS. ;)

< Excited >

I got an Email from Patrick V, the dude who created Slackware. He was asking about the tutorial I wrote!!!

< /Excited >

BSD and Linux are free, and very useable. Both can be used as servers. And both can be secured. But is one really better than the other for a desktop? I think Linux is.....Hmmmm *Off to start a new thread in the OS forum about which is better from a desktop perspective*

Ohhh, gore used a big word like forum, and about! ;)

well on the brighter side atleast openbsd is more secure than M$,can it not be forgiven !!!

In any case, remote hole one or two, OpenBSD is still one of the most secure operating systems out of the box. The developers of the operating system take security very seriously.


--PuRe

FYI, here's the explanation & patch reference posted on [email protected]:

Quote:

---

-----Original Message-----
From: [email protected]
[mailto:[email protected]]On Behalf Of Daniel
Hartmeier
Sent: February 7, 2004 18:55
To: [email protected]
Subject: IPv6 MTU handling problem


An IPv6 MTU handling problem has been reported by Georgi Guninski[1],
which could be used by an attacker to cause a denial of service attack
against hosts reachable through IPv6.

When the MTU (maximum transfer unit) for an IPv6 route is set very low,
the TCP stack will enter an endless recursion when the next TCP packet
is sent. This can be exploited remotely by sending ICMP6 'packet too
big' messages containing such low MTU values. The kernel will
effectively lock up, causing denial of service. It is not believed that
this problem can be used to execute arbitrary code.

IPv6 is enabled by default, but the problem can only be exploited
remotely against hosts which are reachable through IPv6. Hosts with
IPv4 connectivity only are not affected.

The problem is fixed in -current, patches for 3.4-stable and 3.3-stable
are available at

ftp://ftp.openbsd.org/pub/OpenBSD/pa.../011_ip6.patch
ftp://ftp.openbsd.org/pub/OpenBSD/pa.../016_ip6.patch

[1] http://www.guninski.com/obsdmtu.html

---

Ammo

My OpenBSD box is currently impossible to remotely exploit...

'cause its turned off, and everythings unplugged. :rolleyes:

Dhej

There is an exploit I coded with my foot that would **** your box up no matter what you unplugged ;) Yea....Bored.

Quote:

---

Originally posted here by gore
There is an exploit I coded with my foot that would **** your box up no matter what you unplugged ;)

---

I guess technically they could classify that as a local exploit and still keep their tally down to one in 7 years...

Quote:

---

Yea....Bored.

---

I second that. I just got home from work early, its 6:30AM and not 7:40AM. I find it funny that eventhough I work outdoors at night, 32 degrees is too warm to work. Yet the 6 degrees in the forcast for Sunday night is prime weather. And I'm not talking celsius temps either. Making snow at a ski "resort" really changes your weather perspective..., oh well, gotta enjoy the income while it lasts, I'm hearing that I'm out of work in about a week or two, now I have to look for a job in a city that just had 400 tech support people lose their jobs and flood the market so now my tech skills are absolutely worthless. Not to mention my truck is on its last legs 'cause its main bearing went out on me, and silly me I thought that I had ample money saved up to last me 'till I found another job and now I'm trying to figure out how to get enough money for a new friggin' engine.

My life is turning into a country song: my trucks broke, I'm gonna be out of work, my girlfriend lives 800 miles away (until May), and get this my dog is sick. . . And I hate country music.

Back on topic, for a bit.

Your "boot" would be the only local exploit on my box 'cause it doesn't have a monitor or a keyboard, as I only ever ssh into is when I have it running anyway.

Ok, I'm done filling the database with worthless bits of my life..., for now.