Critical vulnerability derails Ruby on Rails Posted by Adel Mubarak , Monday, June 4, 2012 at 9:53 AM, in Labels: Linux Kernel, OpenSource

The H reports on a newly-discovered SQL injection vulnerability in Ruby on Rails, affecting the 3.0.x, 3.1.x, and 3.2.x versions.

The developers of the Ruby on Rails web framework have closed a critical vulnerability which allowed attackers to execute SQL commands on the database server. An "SQL Injection" attack such as this could allow the attacker, for example, to read confidential information without authorisation.

The vulnerability exists in versions 3.0 and later of Active Record, Rail's database layer, and is exposed when using nested query parameters. Code that directly passes parameters to a where method, is affected. For example, using the common idiom params[:id] can be tricked into returning a crafted hash which causes the generated SQL statement to query an arbitrary table.

Another weakness with query generation was also found to affect all versions of Ruby On Rails. Rails 3.2.4 was released with fixes for these, and many other bugs, but due to a number of problems in the release process for 3.2.4, the developers then released Rails 3.2.5. There are also updated versions of Rails 3.1.5 and Rails 3.0.13 to fix the same security problems in older versions of the framework.

Juniper Routing Problem disrupts Level 3 network Posted by Adel Mubarak , Wednesday, November 9, 2011 at 12:35 AM, in Labels: Linux Kernel

Yesterday several US and UK ISPs, including Time Warner Cable, Research in Motion, Eclipse Internet, Easynet and Merula, reported a range of errors and problems on the Level 3 backbone. Level 3 has now confirmed the reports. The cause of the problems appears to have been a bug in Juniper's Junos router operating system affecting the border gateway protocol (BGP).

US ISP Phyber Communications has told various US media organisations that other networks using Juniper routers were also affected by the failure, with most affected devices generating a memory dump and then restarting. Juniper manager Mark Bauhaus confirmed that the company had been made aware of the BGP error in edge routers on Monday morning. He stated that the bug had affected only a small number of Juniper customers and that the company already had a patch for the problem which was awaiting distribution to affected routers.

Source: Linux.com

XtreemOS, Enabling Linux for the Grid Posted by Adel Mubarak , Monday, July 18, 2011 at 9:03 AM, in Labels: Linux Kernel

XtreemOS is a Linux-based Operating System, supporting Virtual Organizations over Grid Computing platforms. The development of XtreemOS is currently funded as an Integrated Project by the European Commission under the Sixth Framework Programme (FP6) sponsorship program. The project started in June 2006 to last for 48 months, thus ending in May 2010. As of beginning 2010, the project has been extended and will last until September 2010. The project is led by INRIA and involves 19 research and industrial partners from Europe and China.

Download it :)

GNU C Library vulnerabilities Posted by Adel Mubarak , Saturday, May 29, 2010 at 5:24 PM, in Labels: Linux Kernel

Referenced CVEs:

CVE-2008-1391, CVE-2010-0296, CVE-2010-0830

Description:

===========================================================
Ubuntu Security Notice USN-944-1 May 25, 2010 glibc, eglibc vulnerabilities
CVE-2008-1391, CVE-2010-0296, CVE-2010-0830
===========================================================
A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 8.04 LTS Ubuntu 9.04 Ubuntu 9.10 Ubuntu 10.04 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: libc6 2.3.6-0ubuntu20.6 Ubuntu 8.04 LTS: libc6 2.7-10ubuntu6 Ubuntu 9.04: libc6 2.9-4ubuntu6.2 Ubuntu 9.10: libc6 2.10.1-0ubuntu17 Ubuntu 10.04 LTS: libc6 2.11.1-0ubuntu7.1 After a standard system update you need to restart all services to make the necessary changes. Details follow: Maksymilian Arciemowicz discovered that the GNU C library did not correctly handle integer overflows in the strfmon function. If a user or automated system were tricked into processing a specially crafted format string, a remote attacker could crash applications, leading to a denial of service. (Ubuntu 10.04 was not affected.) (CVE-2008-1391) Jeff Layton and Dan Rosenberg discovered that the GNU C library did not correctly handle newlines in the mntent family of functions. If a local attacker were able to inject newlines into a mount entry through other vulnerable mount helpers, they could disrupt the system or possibly gain root privileges. (CVE-2010-0296) Dan Rosenberg discovered that the GNU C library did not correctly validate certain ELF program headers. If a user or automated system were tricked into verifying a specially crafted ELF program, a remote attacker could execute arbitrary code with user privileges. (CVE-2010-0830)

Installing libc6-2.11.1 on Ubuntu Posted by Adel Mubarak , at 12:57 PM, in Labels: Linux Kernel

Ubuntu security updates are officially distributed only via security.ubuntu.com.

More information on libc6_2.11.1-0ubuntu7.1_i386.deb:
Exact Size 3779220 Byte (3.6 MByte)
MD5 checksum 05f769d40e681c86bf6769a1f125f205
SHA1 checksum 49083ed7258090677e39ea431b37864c6685dafd
SHA256 checksum 707ac992b3438f9a3b5a84f1ea920662e1abf73f0cd747247856a857a3458a41

You should be able to use any of the listed mirrors by adding a line to your /etc/apt/sources.list

deb http://ftp.de.debian.org/debian experimental main

If you are running Debian, it is strongly suggested to use a package manager
like aptitude or synaptic to download and install packages, instead of doing so manually via
http://packages.debian.org/experimental/i386/libc6/download

Running Internet Explorer on Linux Posted by Adel Mubarak , Thursday, February 18, 2010 at 1:52 PM, in Labels: Linux Kernel, OpenSource

Now, this is tricky. When you have a number of powerful alternatives for Microsoft Internet Explorer in Ubuntu Linux, why do you need IE in Ubuntu anyway. Firefox 3.5 is already the best web browser in the world. The thing is, most of those who want IE installed in their linux laptops/pc's are either web developers and the rest are those who just got stuck in an 'IE only website'. There is a easy hack though. Lets take a look.

• First of all you need to get the latest version of wine. Do the following depending on the version of Ubuntu.

For Ubuntu 9.10 Karmic

• Open Terminal and copy-paste the following line into Terminal(Give password when prompted).

sudo add-apt-repository ppa:ubuntu-wine/ppa

• For Ubuntu versions before Ubuntu 9.10, this is little bit trickier. First you have to get the gpg key and later you to add the wine ppa repo to your sources.list.

• Don't worry, let me make it simple for you. Copy-paste the following line to Terminal to add the gpg key.

wget -q http://wine.budgetdedicated.com/apt/387EE263.gpg -O- | sudo apt-key add -

• Now, add PPA Repo depending on the version of Ubuntu you use. For that, simply copy paste the command into Terminal.

For Ubuntu 9.04 Jaunty

sudo wget http://wine.budgetdedicated.com/apt/sources.list.d/jaunty.list -O /etc/apt/sources.list.d/winehq.list

For Ubuntu 8.10 Intrepid

sudo wget http://wine.budgetdedicated.com/apt/sources.list.d/intrepid.list -O /etc/apt/sources.list.d/winehq.list

For Ubuntu 8.04 Hardy

sudo wget http://wine.budgetdedicated.com/apt/sources.list.d/hardy.list -O /etc/apt/sources.list.d/winehq.list

Install the latest version of Wine

• Now, install the latest version of wine in ubuntu.

sudo apt-get update sudo apt-get install wine cabextract

• Done. Cabextract is a dependency you need to install.

Now Download and Install IEs4linux package

• Download latest IEs4Linux Package.

• Now, unzip the downloaded tar.gz file. (Right click > Extract here).

• Open the extracted folder and double click 'ies4linux' file.

• Choose the 'Run' OR 'Run in Terminal' option.

• Following window will pop up.

• Choose the options you want and that is it.

• Don't ever expect IEs4linux to work as your regular browser. Even the original IE doesn't stand a chance in front of Firefox, Chromium, Google Chrome or Opera ;-)

The 2009 Linux Kernel Summit Report Posted by Adel Mubarak , Sunday, November 1, 2009 at 1:14 PM, in Labels: Linux Kernel

The 2009 Linux Kernel Summit was held in Tokyo, Japan on October 19 and 20. Jet-lagged developers from all over the world discussed a wide range of topics.

The sessions held on the first day of the summit were:

• Mini-summit readouts; reports from various mini-summit meetings which have happened over the last six months.

• The state of the scheduler, the kernel subsystem that everybody loves to complain about.

• The end-user panel, wherein Linux users from the enterprise and embedded sectors talk about how Linux could serve them better.

• Regressions. Nobody likes them; are the kernel developers doing better at avoiding and fixing them?

• The future of perf events; a discussion of where this new subsystem is likely to go next.

• LKML volume and related issues. A session slot set aside for lightning talks was really mostly concerned with the linux-kernel mailing list and those who post there.

• Generic device trees. The device tree abstraction has proved helpful in the creation of generic kernels for embedded hardware. This session talked about what a device tree is and why it's useful.

The discussions on the second day were:

• Legal issues; a lawyer visits the summit to talk about the software patent threat and how to respond to it.

• How Google uses Linux: the challenges faced by one of our largest and most secretive users.

• : is the kernel getting slower? How do we know and where are the problems coming from?

• Realtime: issues related to the merging of the realtime preemption tree into the mainline.

• Generic architecture support: making it easier to port Linux to new processor architectures.

• Development process issues, including linux-next, staging, merge window rules, and more.

The kernel summit closed with a general feeling that the discussions had gone well. It was also noted that our Japanese hosts had done an exceptional job in supporting the summit and enabling everything to happen; it would not be surprising to see developers agitating for the summit to return to Japan in the near future.

Gerrit: Google-style code review meets git Posted by Adel Mubarak , at 1:10 PM, in Labels: Google, Linux Kernel

Gerrit, a Git-based system for managing code review, is helping to spread the popular distributed revision control system into Android-using companies, many of which have heavy quality assurance, management, and legal processes around software. HTC, Qualcomm, TI, Sony Ericsson, and Android originator Google are all running Gerrit, project leader Shawn Pearce said in a talk at the October 2009 GitTogether event, hosted at Google in Mountain View. Click below (subscribers only) for the full report by Don Marti.