Language Selection

English French German Italian Portuguese Spanish

Security

The Source of Vulnerabilities, How Red Hat finds out about vulnerabilities.

Filed under
Red Hat
Security

Red Hat Product Security track lots of data about every vulnerability affecting every Red Hat product. We make all this data available on our Measurement page and from time to time write various blog posts and reports about interesting metrics or trends.

One metric we’ve not written about since 2009 is the source of the vulnerabilities we fix. We want to answer the question of how did Red Hat Product Security first hear about each vulnerability?

Every vulnerability that affects a Red Hat product is given a master tracking bug in Red Hat bugzilla. This bug contains a whiteboard field with a comma separated list of metadata including the dates we found out about the issue, and the source. You can get a file containing all this information already gathered for every CVE. A few months ago we updated our ‘daysofrisk’ command line tool to parse the source information allowing anyone to quickly create reports like this one.

Read more

USB Sees Many Changes For Linux 3.18 Kernel

Filed under
Linux
Hardware
Security

Greg Kroah-Hartman sent in pull requests on Tuesday for the various kernel subsystems he maintains. The USB changes as he put it are "lots of little changes in here, all over the place", per his mailing list post.

Read more

Ten Year Old "Critical" Bug Discovered In OpenBSD

Filed under
Security
BSD

While OpenBSD generally prides itself on being a secure, open-source operating system and focusing more on code corectness and security rather than flashy features, it turns out a potential security bug has been living within OpenBSD for the past decade.

Phoronix German ready "FRIGN" wrote in to Phoronix this afternoon with a subject entitled, "10 year old critical bug in OpenBSD discovered." He pointed out a post today about a bug discovered in OpenBSD's polling subsystem that could allow DDoS-style attacks on servers, "a critical bug in the polling-subsystem in OpenBSD has been uncovered which allows DDoS-attacks on servers using a non-standard derivation from the POSIX-standard in marking file descriptors non-readable when they should return EOF."

Read more

Open source's "shallow bugs" theory hasn't been Shellshocked

Filed under
OSS
Security

It hasn't been a good year for open source. Not for its generally golden reputation for software quality and security, anyway. But in a rush to lay blame for the Bash Shellshock vulnerability (and previously for Heartbleed) some, like Roger Grimes, want to dismantle some of the cardinal tenets of open source, like the suggestion that "given enough eyeballs, all bugs are shallow."

Read more

Tor executive director hints at Firefox integration

Filed under
Moz/FF
Security

Tor, which is capable of of all that and more, crucially blocks websites from learning any identifying information about you and circumvents censorship. It also stymies eavesdroppers from discovering what you’re doing on the Web. For those reasons, it would be a powerful addition to the arsenal of privacy tools Firefox already possesses.

The Tor Browser is already a modified version of Firefox, developed over the last decade with close communication between the Tor developers and Mozilla on issues such as security and usability.

Read more

LibreSSL: More Than 30 Days Later

Filed under
Security
BSD

Instead, libressl is here because of a tragic comedy of other errors. Let's start with the obvious. Why were heartbeats, a feature only useful for the DTLS protocol over UDP, built into the TLS protocol that runs over TCP? And why was this entirely useless feature enabled by default? Then there's some nonsense with the buffer allocator and freelists and exploit mitigation countermeasures, and we keep on digging and we keep on not liking what we're seeing. Bob's talk has all the gory details.
But why fork? Why not start from scratch? Why not start with some other contender? We did look around a bit, but sadly the state of affairs is that the other contenders aren't so great themselves. Not long before Heartbleed, you may recall Apple dealing with goto fail, aka the worst bug ever, but actually about par for the course.

Read more

Secure Linux Systems Require Savvy Users

Filed under
Linux
Security

Patches are available to fix the bash vulnerability known as Shellshock, along with three additional security issues recently found in the bash shell. The patches are available for all major Linux distros as well as for Solaris, with the patches being distributed through the various distros.

Read more

Free Software Foundation statement on the GNU Bash "shellshock" vulnerability

Filed under
GNU
Security

Proprietary, (aka nonfree) software relies on an unjust development model that denies users the basic freedom to control their computers. When software's code is kept hidden, it is vulnerable not only to bugs that go undetected, but to the easier deliberate addition and maintenance of malicious features. Companies can use the obscurity of their code to hide serious problems, and it has been documented that Microsoft provides intelligence agencies with information about security vulnerabilities before fixing them.

Read more

Firejail – A Security Sandbox for Mozilla Firefox

Filed under
Moz/FF
Security

Firejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications. The core technology behind Firejail is Linux Namespaces, a virtualization technology available in Linux kernel. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table, IPC space.

Read more

Blackphone bug bounty programme aims to find flaws in 'surveillance-proof' smartphone

Filed under
Android
Security

SILENT CIRCLE has announced a bug bounty programme for its Blackphone venture designed to find security flaws in the "surveillance-proof" smartphone.

Blackphone is a joint venture of Silent Circle and Geeksphone, known as SGP Technologies. Running a secure PrivatOS operating system, it is what the companies call "a truly surveillance-proof smartphone" in the wake of the past year's NSA revelations.

Read more

Syndicate content

More in Tux Machines

Pear OS Linux Concept Revived as Pearl Linux 1.0 – Screenshot Tour

Pear OS Linux was a very successful Linux distribution based on Ubuntu that wanted to provide an experience similar to Mac OS X. That operating system is gone now, but Pearl Linux wants to replace it. Pear OS Linux managed to have quite an impact on the community, despite the fact that it was offering an almost identical experience to the Mac OS X desktop. Read more

We have a winner! Fresh Linux Mint 17.1 – hands down the best

Linux Mint 17.1 is the first example of what the Mint project team can do when they're focused on their own system rather than on making the latest Ubuntu work with Mint. That’s because Mint 17.1 sticks with the Ubuntu released earlier this year – the first time this desktop Linux has not gone with the more recent Ubuntu. Read more

6 tips for adopting open source

Open source code drives collaborative innovation from a larger pool of developers at a lower cost, which is why federal agencies are adopting the "open source first" model. In fact Sonny Hashmi, CIO of the General Services Administration, recently announced that implementing open source software is among his top priorities this year. Read more

Linux admins: It's time to relearn the art of compiling apps

It used to be that open source software was released only as source code and had to be compiled wherever it was needed. Obviously, that's changed. Today, some will even tell you that compiling source is an improper and problematic way to install software. Tomorrow, it may become more standard than they think. While compiling source is still the basis of many BSDs (though you can get binary packages easily enough), package management came to Linux early on with RPM and branched out everywhere ever since. Package support on Debian and Ubuntu is simply massive. Fedora has a huge number of packages, as do RHEL and CentOS, though the packages available for the latter are generally far older for legacy and stability reasons. Read more