Language Selection

English French German Italian Portuguese Spanish

Insecurity blues: What I learned from my buggy code

Filed under

It hasn't been a good month for my code. Samba, the project I'm responsible for, has had to announce several security flaws. Unfortunately some of them were in code I wrote. I always do a large amount of soul-searching whenever that happens. There's nothing worse than finding out something you were responsible for is the cause of many thousands of people having to waste their time rolling out patches. It always makes me wonder if the time has come to give up this programming lark and end my days peacefully in management, messing up other people's code instead of creating my own.

It's very educational however to look at the causes of the flaws, and try and learn what we can from the bugs and also our reactions to them. Samba is an old program. The initial code was originally written 15 years ago. At that time, modern security problems such as integer wrap (where adding two numbers together can end up with a number smaller than both of them, due to the fixed sizes of integers that processors deal with), or heap overflow vulnerabilities (where overwriting unallocated memory on the program heap can allow a clever attacker to seize control of a program) were unheard of. We knew about buffer overruns (where reading more data into a buffer than was originally allocated for it can cause a security breach) and denial of service attacks, but 1992 was a simpler, less hostile time for network software development. Most initial deployments of Samba were on networks isolated from the main Internet, by technically advanced administrators who knew how to download the source code from the Internet.

More here

More in Tux Machines

Thunderbird 38.3.0 Lands in All Ubuntu OSes

Details about a number of Thunderbird vulnerabilities in Ubuntu 15.04, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS operating systems have been revealed by Canonical in a short security notice. Read more

Linux Mint Devs Want to Know How Many Gamers Are Using the OS

The Linux Mint developers are polling the Linux community to find out how many people are playing games and what they can do to improve the things on their side. Read more

Omnibond Releases CloudyCluster on Red Hat Enterprise Linux in the AWS Marketplace

Today Omnibond announced the release of CloudyCluster running on Red Hat Enterprise Linux in the AWS Marketplace, establishing a new level of HPC research and discovery available to everyone. Read more