Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

15 years later: remote code execution in qmail

qualys.com

Post reply on HN
Print view View original

91–100 of 164 posts

Re: 15 years later: remote code execution in qmail

#91

Post by rq1 »

allover wrote: post #61
gowld wrote: post #53

Earlier quoted context omitted.

The app is vulnerable if it runs in an unsafe environment that allows qmail to access more than 4GB (an absurdly large value when qmail was published in 1997 -- it would cost $5000 plus a rare, expensive machine to hold it). djb's view is that the environment is the responsibility of the admin, not the program's responsibility to enforce sane defaults. This is of course debatable. If the admin uses a recommended envi…

So it's not secure by default.

It is in the sense that the author did specify AFAIK the bounds within it should run, no?

Re: 15 years later: remote code execution in qmail

#92

Post by loup-vaillant »

pwdisswordfish2 wrote: post #88
loup-vaillant wrote: post #77

Earlier quoted context omitted.

> The vulnerabilities were introduced in a third party patch Which patch are you talking about? I don't see anything about a patch in the CVE. > Seems much simpler than patching, let alone trusting someone else's patches. We can patch the issue for good (and with a simple patch, apparently), or we can rely on users not to mess with seemingly unrelated init scripts. Do you trust third party users more than a (likely h…

qmail-verify. It is an "update" of the third party "realrcptto" patch by another third party. It says "third party patch" right there in the sentence I quoted. There is no qmail-verify in original qmail. As to the second question, I trust softlimit from daemontools and that is what I use. https://cr.yp.to/daemontools/softlimit.html Not sure what "messing with seemingly unrelated init scripts" means. Can you be more s…

I could trust softlimit all right, but my point was that I wouldn't trust users to wield it correctly.

Re: 15 years later: remote code execution in qmail

#93

Post by boolcow »

kstrauser wrote: post #89
derefr wrote: post #85

Earlier quoted context omitted.

I presume that a DJB-minus-ego wouldn't have had any motivation to become DJB in the first place ;)

Oh, I don't know about that. There are lots of brilliant computer scientists and mathematicians with reputations for also being really nice and humble people. The smartest people I know freely admit when they're at the edge of their knowledge and abilities, and are the first to tell you when they've made mistakes.

Almost everyone who has worked really hard to be great at something has an ego about it. In most cases, they really wanted to be better than (often some specific) others.

To pick some well know people, I'd say Feynman and Einstein both had massive egos. They "knew" they were smart. They also had reputations for being really nice and humble.

It would be simpler to just admit that you think DJB is a bit of a jerk. Linus Torvalds is a bit of a jerk too, in most people's estimation. Brilliant jerks, we call them.

They can make great workers and are always terrible leaders.

Re: 15 years later: remote code execution in qmail

#94

Post by kelnos »

dullgiulio wrote: post #10
DominoTree wrote: post #6

Serious question: Was there a legitimate reason they didn't patch this stuff when it was first discovered?

It's not "they", it's Daniel J. Bernstein. That's the reason :) (If you don't know: he is a top cryptographer that can amazingly correct code. However, he also has a very big ego...)

The funny thing about that is I find his code to be very difficult to read (even just the snippets in the linked CVE illustrate this).

And his attitude is just bonkers to me. "I'm not going to fix this exploitable security issue because I assume that people will configure their environment in a particular way." What? That's... flat-out irresponsible.

Re: 15 years later: remote code execution in qmail

#95

Post by kelnos »

rurban wrote: post #63
kbenson wrote: post #59

Earlier quoted context omitted.

he had such confidence in his software and abilities that he thought it was actually secure, and there were no bugs, and posted a bounty for any exploit that could be found. Patching it means acknowledging it's an exploit, and that his code was not without bugs. Given that his principles of writing secure software (included in the Qmail guarantee[1]) includes this: "7. Write bug-free code." that might be a bit hard f…

Well, he used it with memory limits command line switches, so it could never be exploited. So he was technically correct. One should not use so much memory for a mail server, way too risky. Problem is, these switches were not default, people didnt use it because they are dumb, and DJB never cared to properly maintain it. like limiting memory per default, 32bit only builds or such.

My opinion on this is that if you're going to claim that you write the most secure software in the world, it should be secure by default. It shouldn't require you to modify the configuration in a particular way, or start it in a particular way, in order to be secure. The more details you need to know in order to secure something, more less likely you'll tick off all those boxes.

To me, this is just DJB's ego not allowing him to admit that he made mistakes.

Re: 15 years later: remote code execution in qmail

#96

Post by kstrauser »

boolcow wrote: post #93
kstrauser wrote: post #89

Earlier quoted context omitted.

Oh, I don't know about that. There are lots of brilliant computer scientists and mathematicians with reputations for also being really nice and humble people. The smartest people I know freely admit when they're at the edge of their knowledge and abilities, and are the first to tell you when they've made mistakes.

Almost everyone who has worked really hard to be great at something has an ego about it. In most cases, they really wanted to be better than (often some specific) others. To pick some well know people, I'd say Feynman and Einstein both had massive egos. They "knew" they were smart. They also had reputations for being really nice and humble. It would be simpler to just admit that you think DJB is a bit of a jerk. Linu…

There’s a big difference between self-assessed qualifications, and ability to admit fallibility. Good scientists know they know a lot. Great scientists know that they don’t know a lot, and admitting that you might be wrong is critical for the scientific method to work.

So DJB is brilliant, but if he admitted that he could make mistakes (or even that a compiled could mis-compile his flawless code), then he might have put in failsafes like unreachable code assertions that would have meant that we wouldn’t be discussing this today.

I don’t think he’s a jerk. I don’t know enough about him; maybe he’s the nicest, kindest guy around. I do think the evidence suggests that he’s arrogant, though, and that’s not a good look on anyone.

Re: 15 years later: remote code execution in qmail

#97

Post by pwdisswordfish2 »

loup-vaillant wrote: post #92
pwdisswordfish2 wrote: post #88

Earlier quoted context omitted.

qmail-verify. It is an "update" of the third party "realrcptto" patch by another third party. It says "third party patch" right there in the sentence I quoted. There is no qmail-verify in original qmail. As to the second question, I trust softlimit from daemontools and that is what I use. https://cr.yp.to/daemontools/softlimit.html Not sure what "messing with seemingly unrelated init scripts" means. Can you be more s…

I could trust softlimit all right, but my point was that I wouldn't trust users to wield it correctly.

softlimit is not difficult to use, certainly no more difficult than patch. programs like tinydns-conf for example autmatically generate a run script containing softlimit with a recommended -m setting. maybe qmail needs something similar.

Re: 15 years later: remote code execution in qmail

#98

Post by kstrauser »

derefr wrote: post #90
kstrauser wrote: post #89

Earlier quoted context omitted.

Oh, I don't know about that. There are lots of brilliant computer scientists and mathematicians with reputations for also being really nice and humble people. The smartest people I know freely admit when they're at the edge of their knowledge and abilities, and are the first to tell you when they've made mistakes.

You're talking about other people's motivations. But DJB minus ego wouldn't be some other person, he'd still be DJB; just "DJB if you cut a certain part of his brain out." And I don't think that that person would have any other motivation-generating part of his brain left. His works specifically seem entirely ego-driven. DJB minus the ego probably wouldn't have had any interest in becoming an information-worker at al…

I concede this point. May I modify my original statement? I wish DJB took motivation from non-ego sources, so that we could have the wonderful things he’s made, but even more wonderful because they were made by someone who knew they were fallible.

Re: 15 years later: remote code execution in qmail

#100

Post by saagarjha »

kevincox wrote: post #37
jstimpfle wrote: post #33

Earlier quoted context omitted.

Shoot I have done that in the past but it seems I actually wanted __builtin_trap().

Yeah, that footgun should really have a more explicit name. __dear_compiler_i_promise_that_this_statement_is_unreachable_and_you_may_optimize_based_on_my_good_word_upon_penalty_of_undefined_behaviour()

Even better, just actually perform undefined behavior on that branch and the compiler will get rid of it.
Post reply on HN