Random number bug blights FreeBSD
The devil's in the detail
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
The FreeBSD project pushed out a brace of updates on Thursday to guard against a pair of potentially serious security vulnerabilities.
First up is an update that patches a bug in the GNU tar archiving utility that created a mechanism for hackers to overwrite files on a vulnerable system.
The bug, which stems from insufficient checking, affects an alternative utility that does much the same job as the more widely used bsdtar archiving tool. Bsdtar has been the default archiving utility since FreeBSD 5.3.
More seriously, security researchers have discovered that it's possible for attackers to access the internal state tracking used in the pseudo-random number generators, random and urandom, bundled with FreeBSD.
The flaw is akin to the bugs in pseudo-random generators within Windows XP and 2000 and has much the same effect. As such, the bug enables hackers to determine "random numbers" that underpin the security of encryption functions, such as SSL transactions.
Hackers are likely to need local access to vulnerable systems, so attacks based on the cryptographic weakness are far from straightforward. An update from the FreeBSD project is designed to secure systems against possible attack.
FreeBSD, well regarded as a stable OS, is most commonly used as a web server platform. Fixing the pseudo-random generator bug involves a system reboot, which could be an issue in some hosting environments.
More information on the update can be found in an advisory from the FreeBSD Project here. ®
COMMENTS
Single-line fix
The patch was a trivial single-line fix. Looks like some developer made a silly mistake.
A bug in GNU tar is a BSD problem first and foremost *how*?
So GNU tar had a security flaw. Great. So why is this being reported as news for FreeBSD? On FreeBSD, GNU tar is a niche application, as many of the people there prefer to use tools that anyone can convert to proprietary, rather than ones with restrictive licenses that prevent that, and most, if not all of the rest, prefer tools with minimal code bloat; gnu tar's --help option *alone* could make the program too bloated for the average BSDer's taste. However, the fact that the FSF have extended their tar program to the point where it actually *supports* all of the options that its help option indicates it can handle basically puts it in the 'right out' category for every BSDer that I have personally talked to about GNU tar.
OMG - amanfromMars finally makes sense?
I must be reading El Reg way to much - I can finally understand what amanfromMars is saying...
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
