kerneltrap.org/node/7228
Rapid7 explains, "the NVIDIA Binary Graphics Driver for Linux is vulnerable to a buffer overflow that allows an attacker to run arbitrary code as root. This bug can be exploited both locally or remotely (via a remote X client or an X client which visits a malicious web page). A working proof-of-concept root exploit is attached to this advisory." The advisory goes on to note that the FreeBSD and Solaris binary drivers are also likely vulnerable to the same flaw and cautions, "it is our opinion that NVIDIA's binary driver remains an unacceptable security risk based on the large numbers of reproducible, unfixed crashes that have been reported in public forums and bug databases."
the link in the advisory is the earliest thread in which we could find an NVIDIA employee publicly acknowledging the bug, although it was reported back in 2004 and has probably existed even longer." Regarding the decision to announce the exploit to the public Chad explained, "I expect (or hope) that NVIDIA will fix the defect in their binary drivers quickly. I don't know anything about their development process or where their Linux drivers fit into their priority list. It seems that the majority of Linux users are perfectly willing to accept bugs in binary blob drivers from hardware vendors, so there is little incentive for NVIDIA to change their process."
html Its a bit ironic how these Rapid7 guys are foaming at the mouth about NVIDIA's awareness of the issue when Rapid7 wasn't even aware that its been fixed for weeks now.
reply Since you are obviously so co Comment posted by Anonymous (not verified) on Monday, October 16, 2006 - 16:19 Since you are obviously so concerned about such a heinous security hole, you must have some real-world examples of computers that have been compromised using this exploit, no?
Of" by Anonymous (not verified) fix it, don't hype it Comment posted by postmodern (not verified) on Monday, October 16, 2006 - 18:14 Most Linux distros are pre-configured to not listen on a TCP socket for remote X session requests. Furthermore, most distros that ship with services enabled by default have them bound to the localhost interface, making remote access to them impossible. We should be concerned about this and upgrade immediately to the beta driver which fixes this buffer-overlay/privilege-escalation. But this vuln is being over hyped, trying to make it into that sshd vuln that came out around 2002.
reply Here is nice special link the Comment posted by Anonymous (not verified) on Monday, October 16, 2006 - 18:53 Here is nice special link the authors of the advisory have shown a few people who say this "this vuln is primarily local".
Or not as t Comment posted by Anonymous (not verified) on Monday, October 16, 2006 - 22:38 That is awesome. It sits there for a bit, then the firefox could not render page comes up and almost immediatly the X server crashes and I am presented with the login screen. This bug could be exploited to do whatever by just visiting a web page!
reply Do _not_ open this url, read Comment posted by Anonymous (not verified) on Monday, October 16, 2006 - 22:39 Do _not_ open this url, read it carefully and you'll see it's a nasty trick.
reply Can someone who is not runnin Comment posted by Anonymous (not verified) on Monday, October 16, 2006 - 23:01 Can someone who is not running the nvidia closed source drivers capture this exploit (from the link above) to verify its exsistence and log this event properly?
reply It's not NVidia specific, rat Comment posted by Anonymous (not verified) on Tuesday, October 17, 2006 - 00:06 It's not NVidia specific, rather a bug in Firefox - it crashes when running on X with ATI open-source driver too.
reply It is the NVIDIA bug Comment posted by Anonymous (not verified) on Tuesday, October 17, 2006 - 00:24 It is the NVIDIA bug. Firefox without the NVIDIA blob simply displays 'Document contains no data' without any incident.
Comment posted by Anonymous (not verified) on Tuesday, October 17, 2006 - 10:10 All that happened when I clicked on the link is a short delay and then the URL bar got a long black line through it and the page displayed a "the connection was reset" error.
reply I asked if you knew of any co Comment posted by Anonymous (not verified) on Monday, October 16, 2006 - 22:12 I asked if you knew of any computers that had been compromised by this, and you're telling me "run it yourself", which kind of illustrates my point, doesn't it? To compromise your PC it requires you to run something locally OR It requires a user to allow external X clients to connect to the X server AND it requrires shell access for the attacker to gain info about memory locations so that the hostile X client will know where to insert the malicious code. I'm not saying that it's not a problem, or it shouldn't be fixed (though it apparently has been now) but I am saying that it isn't the catastrophic security threat that the "OSS Uber Alles" folks are wishing it to be. That "security advisory" was an Op Ed piece denouncing the evils of closed source drivers. And much like your hostile ranting on the same subject, it does more to discredit your cause than serve it.
reply If you are using the nvidia d Comment posted by Anonymous (not verified) on Tuesday, October 17, 2006 - 04:45 If you are using the nvidia driver in a school for example where a large number of students have access to the computers it might be a large problem if someone has root access to the computer and install a keylogger, rootkit or whatever...
Omnifarious on Tuesday, October 17, 2006 - 10:52 Where is the accountability and control? It is a problem, and it's exactly the kind of problem that Open Source deals with well and closed source deals with horribly. It shouldn't take an example of someone succumbing to the problem for the problem to be fixed. It should've been fixed 2 years ago when it was discovered, not now when it's embarassing them. As soon as there's a graphics card with 80% the performance of an nVidia card and Open Source drivers, I'm buying it. They make a nice graphics card, but in all other respects their company is awful. They won't even open the source to the drivers for their motherboard hardware. I won't use their motherboard hardware for that exact reason. The last thing I need is an exploit in my ethernet driver that doesn't get fixed for several years because nobody made a public stink about it.
reply I can't find anything in the Comment posted by Anonymous (not verified) on Monday, October 16, 2006 - 13:33 I can't find anything in the release notes about a fix for this bug. If it has been, how does the average user get aware of the fact that an update is advisable? Or does the average user update to BETA versions in a timely fashion on principle?
s=87867d1f473f5e912c4 12a23e19a8dc3&p=1027749&postcount=11 It's a real shame they do not mention the bugfix in the release notes, let alone publically urge their users to upgrade.
reply "Re: X server crash on manipu Comment posted by Anonymous (not verified) on Monday, October 16, 2006 - 14:19 "Re: X server crash on manipulation of certain strings" Maybe it does fix also the vunerability, and not only the specific crash reported there.
reply bs, there is no such thing as Comment posted by Anonymous (not verified) on Tuesday, October 17, 2006 - 00:02 bs, there is no such thing as closed source. Learn to read assembly and quit jabbering about not having the source.
reply No such thing as closed sourc Comment posted by Anonymous (not verified) on Tuesday, October 17, 2006 - 07:43 No such thing as closed source ? Why do you think the GPL specifically mentions that the preferred form of source code includes makefiles and that kind of thing ? Yes, it's to avoid smartarse lawyers that'd say "you got the assembler, so you got the source".
reply It's because their drivers ar Comment posted by Anonymous (not verified) on Monday, October 16, 2006 - 18:33 It's because their drivers are the buggier than early Vista betas. I can't count on both hands and feet how many different issues I've had with their Linux driver and what still hasn't been fixed.
Everyone meet Lonni Comment posted by Anonymou...
|