Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

16 years of CVE-2008-0166 – Debian OpenSSL Bug

16years.secvuln.info

Post reply on HN
Print view View original

31–40 of 68 posts

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#31

Post by tetha »

Latty wrote: post #29
cassianoleal wrote: post #24

Earlier quoted context omitted.

_sigh_ the backdoor was found because Debian also made those patches. Nearly all major distros were affected. The reason why Debian made the news is because the researcher who found the issue was using Debian. Had he been using Ubuntu, Arch, Fedora... those would have been in the news instead.

According to Arch: "openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma. Arch does not directly link openssh to liblzma", so at least one of your examples is wrong. That specific vulnerability was not in Arch. The xz package was potentially vulnerable (although not in reality because "the build script w…

>"openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma. Arch does not directly link openssh to liblzma", so at least one of your examples is wrong. That specific vulnerability was not in Arch.

This is such a weird formulation though, because "other distributions" apparently included insignificant parts of the linux landscape like Fedora (i.e. the testing variant of the RedHat world) and SUSE.

And if the three largest upstream distris in the linux world have this mistake, calling that "Well some distris, but screw mostly Debian" doesn't sound like a strong point.

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#32

Post by aspenmayer »

throwaway6272 wrote: post #9
aspenmayer wrote: post #5

Earlier quoted context omitted.

> That's the IT sec version of placing your CV on their server to apply :) Has this actually ever happened or been solicited? That’s an interesting thought experiment. https://en.wikipedia.org/wiki/Calling_card_(crime) https://en.wikipedia.org/wiki/Website_defacement https://attrition.org/mirror/ https://www.zone-h.org/archive

I did this, kind of. I was interviewing for a financial company that went to some effort to hide their location for operational security, met them at a local cafe where we talked about physical security, and then casually mentioned that I was staying at an airbnb across the road from their office and we could walk back together. It took a couple of calls to find someone who happily told me their registered address. T…

Wouldn't their registered address be public information? I understand that corporations may use agents/lawyers for that kind of thing, with layers of shell companies, but in theory this kind of info is able to be discovered and deduced from tax records, incorporation documents, and for publicly traded companies, SEC filings, etc.

Cool story! I'm glad you got the job! Anything else about your sleuthing you'd care to add? I'm intrigued.

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#33

Post by tedunangst »

anonbanker wrote: post #25

Every day, Ted Unangst is vindicated more and more[1] for his work forking OpenSSL. If you do a little digging, you'll see that there was no real technical reason why your distro of choice has abandoned implementing LibreSSL[2][3], or just never implemented it at all[4]. They just somehow wanted to keep using the faulty software with exploit mitigation countermeasures[5][6]. Totally organic. 1. https://flak.tedunangs…

I don't think that has anything to with this, though.

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#34

Post by b112 »

hxelk1 wrote: post #22
mistrial9 wrote: post #20

Earlier quoted context omitted.

this is such a spin! that bug was two years worth of James Bond-level insertions into a situation that "was caused" by systemd ! if you want to get creative in the rewriting of fact

This isn't about systemd. OpenSSH is one of the most (if not the most) security-critical program in the distribution. Many systems run with just ssh enabled. That's why you don't mess with it. Which library pulled the vulnerability in is mostly irrelevant.

When the init system won't reliably start openssh, and insists the only fix is to patch, then blame the horrible init system.

And that was what happened with systemd.

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#35

Post by Latty »

tetha wrote: post #31
Latty wrote: post #29

Earlier quoted context omitted.

According to Arch: "openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma. Arch does not directly link openssh to liblzma", so at least one of your examples is wrong. That specific vulnerability was not in Arch. The xz package was potentially vulnerable (although not in reality because "the build script w…

>"openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma. Arch does not directly link openssh to liblzma", so at least one of your examples is wrong. That specific vulnerability was not in Arch. This is such a weird formulation though, because "other distributions" apparently included insignificant parts o…

I wasn't claiming Debian were somehow singularly at fault, the poster just specifically said Arch was also vulnerable, which wasn't true.

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#36

Post by [deleted] »

cassianoleal wrote: post #24
hxelk1 wrote: post #18

Earlier quoted context omitted.

I believe the xz backdoor relied on Debian patching OpenSSH with libsystemd to work.

_sigh_ the backdoor was found because Debian also made those patches. Nearly all major distros were affected. The reason why Debian made the news is because the researcher who found the issue was using Debian. Had he been using Ubuntu, Arch, Fedora... those would have been in the news instead.

[deleted]

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#37

Post by cassianoleal »

Latty wrote: post #29
cassianoleal wrote: post #24

Earlier quoted context omitted.

_sigh_ the backdoor was found because Debian also made those patches. Nearly all major distros were affected. The reason why Debian made the news is because the researcher who found the issue was using Debian. Had he been using Ubuntu, Arch, Fedora... those would have been in the news instead.

According to Arch: "openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma. Arch does not directly link openssh to liblzma", so at least one of your examples is wrong. That specific vulnerability was not in Arch. The xz package was potentially vulnerable (although not in reality because "the build script w…

Right... I may have wrongly named Arch in my comment. Thanks for the correction.

I'm curious about Arch's claim that "the build script was configured to only inject the bad code in Debian/Fedora based package build environments". Were Debian and Fedora specifically targetted, and the other distros who also got affected just happened to use similar packaging routines, or is this claim a guess?

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#38

Post by csande17 »

cassianoleal wrote: post #37
Latty wrote: post #29

Earlier quoted context omitted.

According to Arch: "openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma. Arch does not directly link openssh to liblzma", so at least one of your examples is wrong. That specific vulnerability was not in Arch. The xz package was potentially vulnerable (although not in reality because "the build script w…

Right... I may have wrongly named Arch in my comment. Thanks for the correction. I'm curious about Arch's claim that "the build script was configured to only inject the bad code in Debian/Fedora based package build environments". Were Debian and Fedora specifically targetted, and the other distros who also got affected just happened to use similar packaging routines, or is this claim a guess?

The malicious build script included heuristics to only include the backdoor if you were building a .deb or .rpm package (the Debian and Fedora formats respectively). Other distros would have been affected if they used the same packaging setup -- Ubuntu also uses .deb, for example, because it's based on Debian.

And some distros IIRC considered themselves "affected" if they ever used a malicious version of the code, just in case, even if the backdoor didn't actually get compiled in to their version.

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#39

Post by throwup238 »

cassianoleal wrote: post #37
Latty wrote: post #29

Earlier quoted context omitted.

According to Arch: "openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma. Arch does not directly link openssh to liblzma", so at least one of your examples is wrong. That specific vulnerability was not in Arch. The xz package was potentially vulnerable (although not in reality because "the build script w…

Right... I may have wrongly named Arch in my comment. Thanks for the correction. I'm curious about Arch's claim that "the build script was configured to only inject the bad code in Debian/Fedora based package build environments". Were Debian and Fedora specifically targetted, and the other distros who also got affected just happened to use similar packaging routines, or is this claim a guess?

Me too, especially since many packages on Arch begin by downloading the official .deb/.rpm

Re: 16 years of CVE-2008-0166 – Debian OpenSSL Bug

#40

Post by kbolino »

aaronmdjones wrote: post #11
jsiepkes wrote: post #8

Earlier quoted context omitted.

While you can forge the DKIM signature there is a good chance there is also SPF configured. SPF tells which servers are allowed to send mail for the domain. So your email would likely still end up in the spam folder.

DMARC only requires one of SPF or DKIM to pass. DKIM passing and SPF failing won't deter DMARC; the message will land in the inbox.

That is a common DMARC configuration but not the only one. The failure tolerance is configurable.
Post reply on HN