Language Selection

English French German Italian Portuguese Spanish

Flaws could open systems to attack

Filed under
Security

Two serious security flaws in a technology widely used for network authentication could expose a swath of software products to hacker attack, experts have warned.

The flaws could allow an online intruder to crash or gain access to computers running Kerberos, a freely available authentication technology that was developed by the Massachusetts Institute of Technology.

MIT rates both flaws "critical," according to two advisories released Tuesday. The university also made available patches to fix the problems and stated that exploitation of the bugs by attackers "is believed to be difficult."

Several software makers have already released updates to their products to address the problem. Red Hat, Turbolinux and Gentoo have issued fixes for their Linux versions, for example. Sun Microsystems on Tuesday issued two alerts acknowledging that several versions of Solaris are vulnerable, but it does not have a patch available yet.

Because Kerberos is so widely used, more vendors are likely to publish security alerts, said Brian Grayek, chief technology officer at Preventsys, a vulnerability management company in Carlsbad, Calif. "I think you are going to see a floodgate of patches open," he said.

Microsoft also uses Kerberos, but a homegrown version that is not affected by the flaws.

Both bugs affect Kerberos 5 Release 1.4.1 as well as earlier versions, according to MIT.

Independent security-monitoring company Secunia rates the issues "highly critical," its second most serious rating. The French Security Incident Response Team, or FrSIRT, deems the bugs "critical," its highest ranking.

Preventsys' Grayek agreed that the vulnerabilities are serious but noted that crafting attacks is difficult. "It is going to take somebody with a great deal of knowledge to turn these vulnerabilities into exploits," he said.

This isn't the first flaw in Kerberos. In March, MIT warned of a "serious" bug in the telnet program supplied with Kerberos. Last August, a "critical" flaw was discovered and patched.

Earlier this month a vulnerability in another widely used software component exposed some of the same products to attack. That flaw affects the open-source "zlib" data compression technology. Using a specially crafted file, an attacker could take control over a computer or crash applications that use zlib.

Source.

More in Tux Machines

Red Hat CTO unexpectedly quits, amid rumors of executive 'friction'

No-one among the rank and file at Red Hat seem to have seen this coming. In a move the Linux giant's staffers said was "shocking" and a "punch in the gut," long-time Red Hat chief technology officer Brian Stevens has resigned. In a short press release, the company announced: "Brian Stevens will step down as CTO." In the same release, Red Hat's president and chief executive Jim Whitehurst said, "We want to thank Brian for his years of service and numerous contributions to Red Hat’s business. We wish him well in his future endeavors." Read more

Is Microsoft engaging in digital imperialism?

Windows, the common carrier of Microsoft, is such a sordid mess that it suffers regular glitches and conducts mass surveillance on users. Microsoft knows that without Windows it cannot survive, so dirty tricks resume in a very big way. This is not a beep on the radar but somewhat of a surge. Nothing is going to change in Munich, but Microsoft is trying to maintain an international/universal perception that the migration to GNU/Linux was a disaster. Numerous anonymous blogs were created to attack Munich over this and provocateurs of Microsoft loved citing them, only to be repeatedly proven wrong. Microsoft is trying to make an example out of Munich in all sorts of nefarious ways. We need to defend Munich from this malicious assault by the convicted monopolist and corrupt enterprise that’s acting as though it fights for its very survival (while indeed laying off tens of thousands of employees). Read more

Shortlist of open source software used at NASA lab

Yes! We use a lot of open source. The short list includes Python, GitHub, Processing, VLC, jQuery, D3.js, Blender, VRUI, ImageJ, VMD, ParaView, MeshLab, VNC, ImageMagick, SWIG, Emacs, and many more. We like using open source because it gives us more flexibility because of licensing and allows us the opportunity to contribute back to the community using our expertise. Our favorite open source project that we work on is OpenMDAO. This project is run out of another Division at our Center. Our team provides some programming support. OpenMDAO is an open source Multidisciplinary Design Analysis and Optimization (MDAO) framework, written in Python. You can use it to develop an integrated analysis and design environment for your engineering challenges. Read more

GSoC: Thumping the Malaria and voyaging in cosmos with KStars

Let's talk about my project now. KStars is desktop planetarium application under KDE Education Projects. I developed QML based cool interface to enable users to browse through image database of community of astrophotographers (i.e. astrobin.com) which contains more than 1,20,000 (number is increasing everyday) real time and very high resolution images along with various information related to them (i.e. Date on which image was captured, Bortle Dark-Sky Scale, RA Centre, DEC Centre, Telescope or Camera used, Description added by astrophotographer etc). I am sure that this browser will enthrall school children by showing them real time images of stars and galaxies located at hundreds of light year far from earth. Read more