Vulnerability Update: libarchive | Hacker News Reader

Vulnerability Update: libarchive

hardenedbsd.org

66 pointsutternerd20 comments

> Around three months ago, a post was published (mirror) on GitHub's Gist service. In the report, multiple vulnerabilities against portsnap, freebsd-update, bspatch, and libarchive were detailed. To this date, FreeBSD has been silent on official mailing lists.

Why didn't the poster file the bugs in the FreeBSD bug tracker and/or contact the FreeBSD security team? Even posting to the mailing list would have been better than posting on some random github page. I don't think you can fault the FreeBSD people for not seeing some random post online.

Have you tried using some of the bug trackers in FOSS? Debian, python, mozilla, freeBSD are both quite a pain to use and most of all, you lose track of thee global picture. Especially when core devs have a tendency to either let the bugs opened or close them for no reasons.

The unsane default of freeBSD are quite known. Having a list of them give the picture.

I actually run FreeBSD to escape systemd insanity. BSD communities are far smaller than linux one, it is also a little bit «secretive» (compared to all the docs and books) on how to build drivers.

Since the linux ecosystem is having all the «heavy weight» desktop applications and that freeBSD has invested quite a lot in linux compatibility I fear they lack resources to do everything.

But, remember that ubuntu is providing LTS distributions with an amazing number of very used non patched packages.

The state of security in linux/windows/mac OSX/BSD is a direct consequence of the multiplication of bloatware package that are poorly maintained and sometimes coded.

There will be a time for cleaning.

Submitting a Debian bug needs a single email with one required header line, hardly a pain to use.

FreeBSD uses Bugzilla, which is a bit more work than that, but certainly nothing beyond the grasp of anyone on HN.

...and significantly easier than the old GNATS-based system that preceded it.

There have been active efforts within the project to make this sort of thing much easier for newcomers than it used to be.

> Have you tried using some of the bug trackers in FOSS?

As a matter of fact, I have, thank you for asking.

* https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205776

* https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205777

* https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205778

* https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205786

* https://bugs.freenas.org/issues/12986

* https://bugs.freenas.org/issues/12987

* https://bugs.freenas.org/issues/12988

More info and theories: https://github.com/libarchive/libarchive/issues/743

It did also make at least one FreeBSD list - https://lists.freebsd.org/pipermail/freebsd-security/2016-Ju... with the appropriately terse followup https://lists.freebsd.org/pipermail/freebsd-security/2016-Ju...

I added the 2 HardenedBSD fixes to the libarchive issues at least.

If you're interested in securing software update systems, check out The Update Framework. TUF is the only system I'm aware of that has a comprehensive threat model for the problem of securely distributing software updates.

https://theupdateframework.github.io

And it has a BSD license, too. Unfortunately it's written in Python. I don't see Python becoming a requirement to update FreeBSD.

There is also a BSD-licensed version that we wrote in Go: https://github.com/flynn/go-tuf

But then you would have to ship and support a go compiler with base, which is a similar problem but easier to overcome.

Or ship compiled static binaries.

This would be more feasible, but we'd still need Go in the src tree so users can reproduce them.

The website says there are Python, Ruby, Go, and Haskell implementations of the framework.

Skimmed the spec, it sounds interesting, but I'm seemingly unable to find an architecture diagram / any kind of visualization to let me wrap my head around the actual framework.

I'm not sure how connected to the project you are, but if you're aware of where I might find that, I'd be very thankful for a helping hand.

It's not the only system, unless you assume all of the same requirements and constraints that TUF proposes as necessary. There are other systems that do many of the same things that TUF proposes.

TUF also attempts to address a set of problems that some systems don't need to solve because it isn't a need they have.

With that said, I would agree that TUF provides a great model.

> The libarchive vulnerabilities could allow a malicious third-party to distribute update archives that could place arbitrary files on the filesystem.

Why do people keep doing this crap every time they re-invent the packaging wheel? And it's particularly awful from something purporting to be more secure than vanilla FreeBSD (which generally purports to be "better engineered" than Linux, where sane behaviour for distributing binaries is a long-solved problem).

> (which generally purports to be "better engineered" than Linux, where sane behaviour for distributing binaries is a long-solved problem).

Assuming your "sane behavior" is referencing .deb and .rpm files, both of those let you run arbitrary, attacker-provided shell scripts as root whenever you install, upgrade, or even uninstall a package.

But have mechanisms to assure they aren't tampered with in-flight.

Reply on news.ycombinator.com