15 years later: remote code execution in qmail • Hacker News Board

Re: 15 years later: remote code execution in qmail

#161

Post by dependenttypes » Thu, May 21, 2020, 6:59 PM UTC

Dylan16807 wrote: post #157

dependenttypes wrote: post #149

Earlier quoted context omitted.

How is "safe C" a variant language when it is within what the standard allows?

The unsafeness of C is pretty widespread and fundamental. Whatever code you end up with is either going to be incompatible with normal compilers, or it's going to be so full of library calls that you can barely recognize it as C anymore. Unless you count sandboxing the entire program, and allowing errors inside the sandbox as long as they don't escape. Then C-to-WASM would be a safe C compiler, I guess.

> Whatever code you end up with is either going to be incompatible with normal compilers

I do not believe that this is necessarily the case.

Re: 15 years later: remote code execution in qmail

#162

Post by dependenttypes » Thu, May 21, 2020, 7:30 PM UTC

sneak wrote: post #160

dependenttypes wrote: post #145

Earlier quoted context omitted.

I actually had https://blog.cr.yp.to/20160607-dueprocess.html in mind when mentioning political beliefs, but even then I think that this still falls under the "political belief" label - the belief that anyone accused of rape should not have any form of defence. Anyway, the person who is being sued was part of a harassment campaign against multiple people, including Bernstein himself, so I can't see why it would be a…

People can be onboard 100% with his argument for due process (I am) and simultaneously 100% against his association with Jake Appelbaum, whose (perhaps subcriminal) misbehavior was widely reported in private in our industry prior to the bevy of as-yet-unproven rape accusations. Appelbaum is and has been a scumbag regardless of the fact of whether or not he has been adjudicated a rapist in a court of law. People who a…

> Appelbaum is and has been a scumbag

I do not know him, do you? Most accusations against him that I have seen have been either by the person being sued or some form of hearsay.

It is not too unlikely that he is a scumbag to be honest, but it is still something that I do not know.

> and, indeed, defend them in particular

I contest this claim. He did not defend Appelbaum in this instance, in his declaration even he claims that he is unaware whether Appelbaum is a rapist. The lawsuit is against Lovecruft specifically. Regardless, I do not believe that scumbags do not deserve to be defended. Everyone does, as long as the defence has reasonable points that is.

Btw, can't this post of yours be interpreted as defending Lovecruft if we follow this logic? If so I find this ironic that you try to criticize Bernstein of something that you are doing yourself.

> I also agree in public criticism of entirely legal misbehavior

You must love sites like Kiwifarms then. It is one thing to have open criticism and debate and another to have dog-piling and harassment based on roumors - the ability to defend yourself and have others defend you is one of the most important things that distinguishes the two.

> and freedom of association

Do you also believe that people should be free to refuse to deal with minorities by any chance? This is something that is implied by the freedom of association after all.

> I don’t respect people who defend scumbags socially

Again, the pot calling the kettle black. I do not get this logic to be honest, I will explain why with an example. Let's take a scambag, Jeff Bezos for example, and I start saying that he is a murderer out of nowhere. Is nobody allowed to defend him or ask for evidence just because he is a scambag?

Re: 15 years later: remote code execution in qmail

#163

Post by pwdisswordfish2 » Thu, May 21, 2020, 8:42 PM UTC

loup-vaillant wrote: post #140

pwdisswordfish2 wrote: post #97

Earlier quoted context omitted.

softlimit is not difficult to use, certainly no more difficult than patch. programs like tinydns-conf for example autmatically generate a run script containing softlimit with a recommended -m setting. maybe qmail needs something similar.

I was talking about patching upstream , okay? It's not like the patch would have to be individually applied to each installation by its own admin. Patch upstream once, and poof, all users worldwide are safe as soon as they update.

Perhaps "Seems much simpler than patching" was an ambiguous statement. I was only referring to the perspective I take as an admin for one user: me. I already use softlimit on a daily basis so it is simpler for me than patching. To me, it seems like a cleaner solution. The two complete mitigations presented were a choice between (a) using softlimit and the -m setting used by qmail's author versus (b) applying a third party patch to fix problems caused by another third party patch (qmail-verify, which was an "upadte" of yet another third party patch) and third party configuration settings (Debian). I thought that was noteworthy.

Re: 15 years later: remote code execution in qmail

#164

Post by myrond » Thu, May 21, 2020, 10:02 PM UTC

Maybe this will be useful to someone adding the following flags LDFLAGS='-z relro -z now' help with one of the holes (they mentioned it, but not what flags) Check out: https://github.com/slimm609/checksec.sh

  * System-wide ASLR (kernel.randomize_va_space): Full (Setting: 2)
  * Does the CPU support NX: Yes
  * Core-Dumps access to all users: Restricted
           COMMAND         PID RELRO      STACK CANARY            SECCOMP          NX/PaX        PIE                     FORTIFY
  # checksec --proc-all |grep qmail
      qmail-injectXXXXX27 Full RELRO      Canary found            Seccomp-bpf      NX enabled    PIE enabled             Yes
       qmail-queueXXXXX97 Full RELRO      Canary found            Seccomp-bpf      NX enabled    PIE enabled             Yes
        qmail-sendXXXXX78 Full RELRO      Canary found            Seccomp-bpf      NX enabled    PIE enabled             Yes
      qmail-lspawnXXXXX89 Full RELRO      Canary found            Seccomp-bpf      NX enabled    PIE enabled             Yes
      qmail-rspawnXXXXX90 Full RELRO      Canary found            Seccomp-bpf      NX enabled    PIE enabled             Yes
       qmail-cleanXXXXX91 Full RELRO      Canary found            Seccomp-bpf      NX enabled    PIE enabled             Yes