English - 14

I recently wrote that I'm sometimes a bit unhappy how security issues are handled in free software project.

Now, to have some contrast, today I'll talk about an example how to do it right. Serendipity, the software I'm using to host this blog, had an SQL injection vulnerability. On the same day, they announced it and provide updated packages. The finder of the vulnerability is also mentioned. Now, it is only able to get password-hashes, many other projects probably would've treated this vulnerability as »low-impact« or something like that.
But beside that, they also provide some tipps how to check if the vulnerability has already been exploitet and suggest to change user passwords.

A while back, there was another vulnerability reported in serendipity. The authors said they don't think that it's really a vulnerability and it probably can't be used for anything evil. But anyway, an update was released and announced just to be sure.

Now, that's good security-work. The fact that serendipity has very few vulnerabilities at all already is very good. The fact they treat the few ones proper is even better. Some other projects should have a look at that.

Finally I managed to upload some pictures of the protest at the g8-summit in heiligendamm.

Due to some damn circumstances, I deleted a bunch of images. Some of them could be restored (using the great rescue-suite sleuthkit - not really easy to use, but powerful).

Some more pictures (of the police action against the media activists bus) are uploaded at indymedia.

There was a firework in sight of my window. Sadly it took me three minutes to get the camera in a stable position. Then, after one minute the battery was empty. Also the resolution was set to low.
So it's only a mini-video with three minutes shaking and one minute with a stable camera (note to self: next time load your cam after a longer trip).
Fireworks as OGG Theora/Vorbis (can be played with vlc)

Today I saw that in the Rewe supermarket, they sell remakes of old Nintendo Game and Watch games (called Mini Classics). For those who don't know, Game and Watch where early Nintendo Games, only one game in a device, with an lcd-screen.

I bought the two classics Super Mario Bros. and Donkey Kong Junior (there were some others but none of them seemed to be of the original titles). I also have a quite nice collection of older Game and Watch titles, I think I might upload some pictures of them when I find time for it.

It's an often told story that the free software community cares more about security. That it's much better because everyone can look at the code. While this may sometimes be true and I know many free software projects really care about security issues, often enough it's the exact opposite.

On 26.04., some guy called Marsu released an advisory about the GIMP. Loading files in the sunras-format can lead to a buffer overflow. Now, while it was silently fixed in svn, for a month they didn't put an advisory on their page and they didn't provide an update. Even with the release of new versions (2.2.15, 2.3.17), they somehow »forgot« to mention that it was a security-update.
Now, after looking into the NEWS-file (which is their Changelog), for 2.2.15 there's this little line:
- guard against a possible stack overflow in the Sunras loader (bug #433902)
They didn't mention the word »security«, they didn't give credits to Marsu, they didn't provide a reference to the advisory or the CVE-ID. Now, even worse, for 2.3.17, they forgot to mention that bug at all (it's probably part of the mentioned »lots of bug fixes«).

Now one might say this isn't that critical, because who uses sunras (I also never heared of that format before)? But think about this: I could mail someone a crafted sunras-file, saying it's an old image I found on some backup HD, together with the note that gimp can open it. I think it's not unlikely that someone might open it, especially with some intelligent social engineering. Beside that, EVERY SINGLE security bug should be taken serious.

Now, don't take me wrong. I love the GIMP, it's a great application. I also think that free software is an important precondition for secure software. But it's not the only thing. And as long as many people in the free software community treat security bugs like this, it's no better than those in the proprietary world.

I should read more web comics...

Ramon yesterday pointed me to xkcd (also the source of this sudoku-image). If you look at the earlier images, you'll suddenly think »This guy must have done this in school".

For you lucasarts-lovers, I also like Day after the Day of the Tentacle (although rarely updated).

Up until recently, I had URLs of the form /item/number, which is due to the reason that this was the URL-naming-scheme of bblog, an ancient blogging software I used years back. Now serendipity supports URLs with the title (minus problematic charakters), which is much better for search engines, because they often rate words that appear in the url better. Now, changing the URL after years of blogging doesn't seem appropriate (probably hundreds of links, trackbacks, bookmarks), so I needed some migration path. Serendipity doesn't support two url schemes out of the box, so I hacked some bash to do the trick. This will generate (after changing the url) forward rules (add them to .htaccess after the s9y-stuff), which send a »moved permanently«-answer. This has do be done only once, as there won't be links on new articles with the old scheme.
It's a fast hack and it probably doesn't fit in other situations without changes, but it's a nice example how fast you get somewhere with some bash and sed magic:

for i in `seq 1 31`; do

        wget --quiet -O - http://www.hboeck.de/archives/P$i.html|grep serendipity_title | \

        sed -e 's:^.*href="\([^"]*\)">.*$:\1:g' | \

        sed -e 's:^/\w*/\(\w*\)-.*:RewriteRule ^item/\1 \0 [L,R=301]:g'

done

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
is all I have to say today.

I knew that kindergarden, blitzkrieg, gesundheit and umlaut are german foreign words in the english language. Today I noticed the word »zeitgeist« in an english talk.

Wikipedia has some more examples

Now, once another episode of cross site scripting disclosure. This time we have some free software web applications. Sadly, none of them was able to provide a fix in a decent timeframe.

CVE-2007-1871 XSS in chcounter
CVE-2007-1872 XSS in toendaCMS
CVE-2007-1873 XSS in mephisto

It's terrifying how many sites there are out there with XSS-issues.

http://www.netbeat.de/bestellen/domaincheck.html?<script>alert(1)</script>
http://www.netbeat.de/support/kommentare.html?name="><script>alert(1)</script>
http://www.symlink.ch/users.pl?unickname="><script>alert(1)</script>
http://www.stuttgart.de/sde/search.php?search=%22><script>alert%281%29</script>
http://www.holidayranking.de/search.html?searchSearchString="><script>alert(1)</script>
http://www.freecity.de/suche/index.phtml?gosearch=yes&words="><script>alert(1)</script>
http://search.netdoktor.com/results.html?qt="><script>alert(1)</script>&la=de
http://www.vfb.de/de/suche/index.php?words="><script>alert(1)</script>
http://www.dvd.de/dvd-and-date/alledvd.asp?strTxt="><script>alert(1)</script>

Note: All have been informed more than a week ago. I also had a bunch of others that got fixed after notification of the webmasters.

Napster and MPAA still unfixed.

No text, just some pictures here.

I'm here at the Linux-Infotag 2007 from the linux user group Augsburg. It's a small and familiar event. Seems that there are a lot of freifunk-people (free wlan networks) in augsburg. On my way to Augsburg, fitting to the topic I had to switch trains in the linux-town Treuchtlingen.

I had a talk about 3D-Desktops (Linux 3D-Slides, OpenDocument). Will stay for some more hours.
It's nice to see more local linux events evolving.

Update: Some pictures from the LIT 2007

My laptop (Samsung P35) has an internal card reader (SD and MemoryStick) done by Ricoh. Several other laptops have this device. It's internally connected as a pcmcia-device and shows up as RICOH Bay1Controller on pccardctl ident.

For years now there was no way to get this thing running in linux, which stopped me from doing projects like having a crypto-key on a small SD-Card and insert that on boot. Now, finally someone did the job and reverse engineered the device: sdricohcs

In my first small tests, I could already download some photos from my digital camera card. No problems so far. Now, the only thing I'm really missing with linux on my laptop left is TV-Out (works with ati binary drivers, but they are unstable like hell). I heared some Xorg-devs are already working on it, so maybe I'll soon announce the »nearby 100%« support for Linux on Samsung P30/P35.

I wrote a few days ago (only in german) about my requests to the 1und1-support for information about the hardware of our rootserver (to complete the PCI ID database).

Now, after their first reply, I now got another mail with more useful information: They pointed me to the tool dmidecode, which can find lot's of information about the BIOS and the motherboard. Didn't know that before, it's also useful to find out the BIOS version on a running system.

Now, this looks like what I was looking for:
Handle 0x0002, DMI type 2, 8 bytes
Base Board Information
Manufacturer: FUJITSU SIEMENS
Product Name: D2030-A1