[ab4fdfc] | 1 | <?xml version="1.0" encoding="UTF-8"?>
|
---|
[6ed5123] | 2 | <!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
|
---|
| 3 | "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
|
---|
| 4 | <!ENTITY % general-entities SYSTEM "../../general.ent">
|
---|
| 5 | %general-entities;
|
---|
| 6 | ]>
|
---|
| 7 |
|
---|
| 8 | <sect1 id="vulnerabilities" xreflabel="vulnerabilities">
|
---|
| 9 | <?dbhtml filename="vulnerabilities.html"?>
|
---|
| 10 |
|
---|
| 11 |
|
---|
| 12 | <title>Vulnerabilities</title>
|
---|
| 13 |
|
---|
| 14 | <!-- section g : 'Others' in longindex.html -->
|
---|
| 15 | <indexterm zone="vulnerabilities">
|
---|
| 16 | <primary sortas="g-vulnerabilities">vulnerability links</primary>
|
---|
| 17 | </indexterm>
|
---|
| 18 |
|
---|
| 19 | <sect2 role="package">
|
---|
| 20 | <title>About vulnerabilities</title>
|
---|
| 21 |
|
---|
[47274444] | 22 | <para>
|
---|
| 23 | All software has bugs. Sometimes, a bug can be exploited, for example to
|
---|
| 24 | allow users to gain enhanced privileges (perhaps gaining a root shell,
|
---|
| 25 | or simply accessing or deleting other user's files), or to allow a
|
---|
| 26 | remote site to crash an application (denial of service), or for theft of
|
---|
| 27 | data. These bugs are labelled as vulnerabilities.
|
---|
[6ed5123] | 28 | </para>
|
---|
| 29 |
|
---|
[47274444] | 30 | <para>
|
---|
| 31 | The main place where vulnerabilities get logged is
|
---|
[7076607] | 32 | <ulink url="https://cve.mitre.org">cve.mitre.org</ulink>. Unfortunately,
|
---|
[47274444] | 33 | many vulnerability numbers (CVE-yyyy-nnnn) are initially only labelled
|
---|
| 34 | as "reserved" when distributions start issuing fixes. Also, some
|
---|
| 35 | vulnerabilities apply to particular combinations of
|
---|
| 36 | <command>configure</command> options, or only apply to old versions of
|
---|
| 37 | packages which have long since been updated in BLFS.
|
---|
| 38 | </para>
|
---|
| 39 |
|
---|
| 40 | <para>
|
---|
| 41 | BLFS differs from distributions—there is no BLFS security team, and
|
---|
| 42 | the editors only become aware of vulnerabilities after they are public
|
---|
| 43 | knowledge. Sometimes, a package with a vulnerability will not be updated
|
---|
| 44 | in the book for a long time. Issues can be logged in the Trac system,
|
---|
| 45 | which might speed up resolution.
|
---|
| 46 | </para>
|
---|
| 47 |
|
---|
| 48 | <para>
|
---|
| 49 | The normal way for BLFS to fix a vulnerability is, ideally, to update
|
---|
| 50 | the book to a new fixed release of the package. Sometimes that happens
|
---|
| 51 | even before the vulnerability is public knowledge, so there is no
|
---|
| 52 | guarantee that it will be shown as a vulnerability fix in the Changelog.
|
---|
| 53 | Alternatively, a <command>sed</command> command, or a patch taken from
|
---|
| 54 | a distribution, may be appropriate.
|
---|
| 55 | </para>
|
---|
| 56 |
|
---|
| 57 | <para>
|
---|
| 58 | The bottom line is that you are responsible for your own security, and
|
---|
| 59 | for assessing the potential impact of any problems.
|
---|
| 60 | </para>
|
---|
| 61 |
|
---|
[86ebbad] | 62 | <para>
|
---|
| 63 | The editors now issue Security Advisories for packages in BLFS (and LFS),
|
---|
| 64 | which can be found at <ulink
|
---|
| 65 | url="https://www.linuxfromscratch.org/blfs/advisories/">BLFS Security
|
---|
| 66 | Advisories</ulink>, and grade the severity according to what upstream
|
---|
| 67 | reports, or to what is shown at <ulink
|
---|
| 68 | url="https://nvd.nist.gov/">nvd.nist.gov</ulink> if that has details.
|
---|
| 69 | </para>
|
---|
| 70 |
|
---|
[47274444] | 71 | <para>
|
---|
| 72 | To keep track of what is being discovered, you may wish to follow the
|
---|
| 73 | security announcements of one or more distributions. For example, Debian
|
---|
[7076607] | 74 | has <ulink url="https://www.debian.org/security">Debian security</ulink>.
|
---|
[47274444] | 75 | Fedora's links on security are at <ulink
|
---|
[7076607] | 76 | url="https://fedoraproject.org/wiki/category:Security">the Fedora wiki</ulink>.
|
---|
[47274444] | 77 | Details of Gentoo linux security announcements are discussed at
|
---|
| 78 | <ulink url="https://security.gentoo.org">Gentoo security</ulink>.
|
---|
| 79 | Finally, the Slackware archives of security announcements are at
|
---|
[497d485] | 80 | <!-- To editors: the https version redirects back to the non-https
|
---|
| 81 | version. Not sure why they must do this, but please check
|
---|
| 82 | before turning this to https. -->
|
---|
| 83 | <ulink url="http://slackware.com/security/">Slackware security</ulink>.
|
---|
[47274444] | 84 | </para>
|
---|
| 85 |
|
---|
| 86 | <para>
|
---|
| 87 | The most general English source is perhaps
|
---|
[7076607] | 88 | <ulink url="https://seclists.org/fulldisclosure">the Full Disclosure
|
---|
[47274444] | 89 | Mailing List</ulink>, but please read the comment on that page. If you
|
---|
| 90 | use other languages you may prefer other sites such as <ulink
|
---|
[7076607] | 91 | url="https://www.heise.de/security">heise.de</ulink> (German) or <ulink
|
---|
| 92 | url="https://www.cert.hr">cert.hr</ulink> (Croatian). These are not
|
---|
[47274444] | 93 | linux-specific. There is also a daily update at lwn.net for subscribers
|
---|
| 94 | (free access to the data after 2 weeks, but their vulnerabilities
|
---|
| 95 | database at <ulink
|
---|
[7076607] | 96 | url="https://lwn.net/Alerts/">lwn.net/Alerts</ulink>
|
---|
[47274444] | 97 | is unrestricted).
|
---|
| 98 | </para>
|
---|
| 99 |
|
---|
| 100 | <para>
|
---|
| 101 | For some packages, subscribing to their 'announce' lists
|
---|
| 102 | will provide prompt news of newer versions.
|
---|
| 103 | </para>
|
---|
[6ed5123] | 104 |
|
---|
| 105 | </sect2>
|
---|
| 106 |
|
---|
| 107 | </sect1>
|
---|