6 ms·

FreeBSD 12.4

136 points by SpaceInvader 4y ago

gjadi 4y ago
Congrats to the team. I looked briefly at the relnotes[1], there is some scary stuff, such as this vulnerability in ping(1): https://www.freebsd.org/security/advisories/FreeBSD-SA-22:15.ping.asc https://www.freebsd.org/security/advisories/FreeBSD-SA-22:15... Since a lot of code is shared between BSDs, I wonder if others have the same vulnerabilities. 1: https://www.freebsd.org/releases/12.4R/relnotes/ https://www.freebsd.org/releases/12.4R/relnotes/
- trasz2 4y ago
  Note that, thanks to capsicum(4), this vulnerability is not very exploitable.
  - gjadi 4y ago
    Thanks, I didn't know about capsicum(4) and I completely overlooked the mention of sandboxing in the impact section.
- boomboomsubban 4y ago
  I would assume there's some level of communication between the various security teams, enough that someone would check if OpenBSD/MacOS had the same bug before they went public with it at least.
- rurban 4y ago
  This ping vuln is not shared anywhere. It is based on a freebsd-specific "optimization" from 2019. Other pings are totally different, I also have my own ping, and it's not affected.
- rwaksmunski 4y ago
  > The ping process runs in a capability mode sandbox on all affected versions of FreeBSD and is thus very constrained in how it can interact with the rest of the system at the point where the bug can occur.
- xcdzvyn 4y ago
  This vulnerability was very much overblown. (1) capsicum prevents the attacker from doing anything but making malicious network requests (2) this is just a stack overflow, for ACE the attacker needs to fit their payload in under 40 bytes
eska 4y ago
On one hand it’s great FreeBSD uses capability sandboxing, on the other I’m sick of memory errors since the day before yesterday.
- erk__ 4y ago
  For that there is some interesting work being done with Cheri and specifically CheriBSD which is built in top of FreeBSD https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/cheribsd.html https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/cheri...
YPPH 4y ago
Something I've really come to appreciate with OpenBSD is the stability and ease of in-place upgrades. I'm not very familiar with FreeBSD, but from what I've read it seems it too has stable, straightforward, in-place version upgrades. I'd love to hear people's experiences. I've found with Linux distributions that aren't rolling releases, things tend to break in annoying and insidious ways, such that you generally need to, or at least it is strongly advisable to, fresh install each time. This is probably of less importance given the demise of the monolithic server, but for my own server, I really appreciate it and the avoidance of reconfiguring everything.
- SpaceInvader 4y ago
  Binary upgrades on FreeBSD are fine. I rarely compile my own kernel these days, but even when I did needed a custom kernel I never had any issues. It just works, For me FreeBSD and OpenBSD needs much less maintenance than Linux.
- comprev 4y ago
  It does have a solid and well documented upgrade process, provided you're on the latest stable version prior to executing the upgrade. Fall behind by 3 or 4 versions and it's a long laborious task to upgrade each one. For products containing the OS which are shipped out to customers (NAS, firewalls, appliances, etc) this process might be too high risk, so it's easier to never upgrade - but ship new hardware, usually in the form of a new product. (This is from personal experience taking on a client who still ran internet-facing FreeBSD 9.x servers. Lift & shift to the latest FreeBSD 13.x was far safer)
  - wahern 4y ago
    > For products containing the OS I'm not personally familiar with any commercial products shipping OpenBSD, but it was my understanding that the "proper" way to do this is to fork the OpenBSD build infrastructure, or at least build your own release tarballs, and basically push your own OpenBSD'ish distro. AFAIU, the binary patching and upgrade frameworks make some (limited?) effort to accommodate the creation and maintenance of bespoke releases. But maybe doing it the "proper" way is too difficult or opaque, incentivizing vendors (even more than they usually are) to simply abandon released models.
markstos 4y ago
Telnetd is deprecated here. When I started hosting professional web hosting in 1997, telnet was the standard way to log into servers. FreeBSD, which we used, didn't integrate SSH into the base system until 2000. In practice, no credentials were known to be compromised by sending them in plaintext. I recall a pretty rapid industry switch from telnet to SSH when it became available outside of OpenBSD.
- dpkirchner 4y ago
  It was pretty easy to get someone's password by tailing /var/log/messages and waiting to see a auth failure followed by a success with a totally different username (i.e. not what looks like an entry correcting a typo). That only worked on shared hosting environments, of course.
- nix23 4y ago
  I don't get what you try to say. But i really hope you don't use telnet over a unsecured net..nor rlogin, http (partially true) or ftp (also partially true).
- SpaceInvader 4y ago
  You don't get telnetd enabled by default. To get it working you need to explicitly start it. No idea why you're talking about it here.

136 points by SpaceInvader 4y ago

Congrats to the team. I looked briefly at the relnotes[1], there is some scary stuff, such as this vulnerability in ping(1): https://www.freebsd.org/security/advisories/FreeBSD-SA-22:15.ping.asc https://www.freebsd.org/security/advisories/FreeBSD-SA-22:15... Since a lot of code is shared between BSDs, I wonder if others have the same vulnerabilities. 1: https://www.freebsd.org/releases/12.4R/relnotes/ https://www.freebsd.org/releases/12.4R/relnotes/

trasz2 4y ago
Note that, thanks to capsicum(4), this vulnerability is not very exploitable.
- gjadi 4y ago
  Thanks, I didn't know about capsicum(4) and I completely overlooked the mention of sandboxing in the impact section.
boomboomsubban 4y ago
I would assume there's some level of communication between the various security teams, enough that someone would check if OpenBSD/MacOS had the same bug before they went public with it at least.
rurban 4y ago
This ping vuln is not shared anywhere. It is based on a freebsd-specific "optimization" from 2019. Other pings are totally different, I also have my own ping, and it's not affected.
rwaksmunski 4y ago
> The ping process runs in a capability mode sandbox on all affected versions of FreeBSD and is thus very constrained in how it can interact with the rest of the system at the point where the bug can occur.
xcdzvyn 4y ago
This vulnerability was very much overblown. (1) capsicum prevents the attacker from doing anything but making malicious network requests (2) this is just a stack overflow, for ACE the attacker needs to fit their payload in under 40 bytes

eska 4y ago

On one hand it’s great FreeBSD uses capability sandboxing, on the other I’m sick of memory errors since the day before yesterday.

erk__ 4y ago
For that there is some interesting work being done with Cheri and specifically CheriBSD which is built in top of FreeBSD https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/cheribsd.html https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/cheri...

YPPH 4y ago

Something I've really come to appreciate with OpenBSD is the stability and ease of in-place upgrades. I'm not very familiar with FreeBSD, but from what I've read it seems it too has stable, straightforward, in-place version upgrades. I'd love to hear people's experiences. I've found with Linux distributions that aren't rolling releases, things tend to break in annoying and insidious ways, such that you generally need to, or at least it is strongly advisable to, fresh install each time. This is probably of less importance given the demise of the monolithic server, but for my own server, I really appreciate it and the avoidance of reconfiguring everything.

SpaceInvader 4y ago
Binary upgrades on FreeBSD are fine. I rarely compile my own kernel these days, but even when I did needed a custom kernel I never had any issues. It just works, For me FreeBSD and OpenBSD needs much less maintenance than Linux.
comprev 4y ago
It does have a solid and well documented upgrade process, provided you're on the latest stable version prior to executing the upgrade. Fall behind by 3 or 4 versions and it's a long laborious task to upgrade each one. For products containing the OS which are shipped out to customers (NAS, firewalls, appliances, etc) this process might be too high risk, so it's easier to never upgrade - but ship new hardware, usually in the form of a new product. (This is from personal experience taking on a client who still ran internet-facing FreeBSD 9.x servers. Lift & shift to the latest FreeBSD 13.x was far safer)
- wahern 4y ago
  > For products containing the OS I'm not personally familiar with any commercial products shipping OpenBSD, but it was my understanding that the "proper" way to do this is to fork the OpenBSD build infrastructure, or at least build your own release tarballs, and basically push your own OpenBSD'ish distro. AFAIU, the binary patching and upgrade frameworks make some (limited?) effort to accommodate the creation and maintenance of bespoke releases. But maybe doing it the "proper" way is too difficult or opaque, incentivizing vendors (even more than they usually are) to simply abandon released models.

markstos 4y ago

Telnetd is deprecated here. When I started hosting professional web hosting in 1997, telnet was the standard way to log into servers. FreeBSD, which we used, didn't integrate SSH into the base system until 2000. In practice, no credentials were known to be compromised by sending them in plaintext. I recall a pretty rapid industry switch from telnet to SSH when it became available outside of OpenBSD.

dpkirchner 4y ago
It was pretty easy to get someone's password by tailing /var/log/messages and waiting to see a auth failure followed by a success with a totally different username (i.e. not what looks like an entry correcting a typo). That only worked on shared hosting environments, of course.
nix23 4y ago
I don't get what you try to say. But i really hope you don't use telnet over a unsecured net..nor rlogin, http (partially true) or ftp (also partially true).
SpaceInvader 4y ago
You don't get telnetd enabled by default. To get it working you need to explicitly start it. No idea why you're talking about it here.