On Saturday 17 December 2016 06:11, Bobbie Sellers conveyed the
following to comp.os.linux.security...
Hi readers and typers,
The knowledgeable sorts who inhabit this Newsgroup can
discuss this at their leisure.
If your desktop runs a mainstream release of Linux, chances are you're vulnerable.
<http://arstechnica.com/security/2016/12/fedora-and-ubuntu-0days-show-that-hacking-desktop-linux-is-now-a-thing/>
From the article...
"This time, the exploit takes aim at a flaw in a software library
alternately known as Game Music Emu and libgme, which is used to
emulate music from game consoles. The two audio files are encoded in
the SPC music format used in the Super Nintendo Entertainment System
console from the 1990s. Both take aim at a heap overflow bug
contained in code that emulates the console's Sony SPC700 processor.
By changing the .spc extension to .flac and .mp3, GSteamer and Game
Music Emu automatically open them."
Sounds to me like one needs to explicitly have those two libraries
installed, and I would wager that not everyone does. And of course,
this being FLOSS rather than proprietary software, this vulnerability
will probably get fixed in no time. ;)
Nothing man-made is ever going to be perfect, courtesy of the
fallibility of the species doing the creating. In addition to that,
certain individuals and/or organizations also engage in deliberate
attempts to exploit weaknesses in the software ─ whether out of concern,
as a proof of concept, or whether so as to make a case for their
commercially sold "software protection suites".
Another aspect is that the more GNU/Linux gains in popularity, the more
truly malevolent people will be trying to exploit it by finding
weaknesses ─ criminals, alphabet soup agency spooks, you name it.
That's a given.
Lastly, Ars Technica is pretty decent for a mainstream news source, but
most of the times, the headlines of such news are deliberately
misleading out of sensationalism.
An example of this would be the news that appeared recently about the
initramfs vulnerability, which was advertised in most mainstream media
along the lines of "Hackers can gain access to your system by a
vulnerability in <mumble>". That's misleading because, no, they
couldn't.
One needs physical access to the machine in order to gain root access
that way. Nobody on the internet is going to be able to exploit that.
But the headline drew more readers onto the article, and that was the
sole intent.
Humans are very good at lying to each other. And why wouldn't they be?
Most of them are equally good at lying to themselves, and they're not
even aware of it. ;)
--
= Aragorn =
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)