MESSAGE
| DATE | 2005-06-06 |
| FROM | dspira@att.net (Dave_att)
|
| SUBJECT | Re: [NYLXS - HANGOUT] Device Drivers Filled With Flaws, Threaten Security
|
Whats wrong with this picture? Whoops, Novell software engineering director Crispin Cowan
just shot himself in the foot. Why reveal what we already know, device drivers have to be updated as a natural process of keeping the software current. Of course there will always be people that need older drivers to maintain older peripherals. Novell has made a commitment to Linux and that includes closing any and all security flaws that may effect the security of the O/S. If Novell as a company are selling and supporting Suse then it should be their objective to close up the security gaps. Go Novell.
Dave
-------------- Original message ----------------------
From: "Inker, Evan"
> OK, Please can someone explain why Novell's Director of Software Engineering
> make the following statement publicly:
> " The Linux kernel has been consistently audited for security, but the
> kernel source tree contains huge numbers of outdated device drivers, says
> Novell software engineering director Crispin Cowan."
>
> "Device Drivers Filled With Flaws, Threaten Security"
> Security Focus (05/26/05); Lemos, Robert
>
> Although operating system code has improved in recent years, device drivers
> still have numerous flaws that threaten operating system security. The
> responsibility of securing device driver code lies primarily with the
> third-party hardware vendors that create the drivers, but also with
> Microsoft and the Linux development community.
>
> Automated code-checking firm Coverity said an audit of the Linux 2.6.9
> kernel code revealed that over 50 percent of the discovered flaws existed in
> device drivers. Though those flaws may not have been exploitable, they do
> reflect on the overall quality of code, says Coverity CEO Seth Hallem.
> Microsoft's Windows software development process includes provisions for
> checking third-party code shipped with the operating system and the company
> has an initiative to improve device driver development. The Linux kernel has
> been consistently audited for security, but the kernel source tree contains
> huge numbers of outdated device drivers, says Novell software engineering
> director Crispin Cowan.
>
> Of particular concern are drivers with direct memory access such as USB
> drivers, graphics drivers, and sound drivers, since code launched from those
> can overwrite system memory. Networking, wireless, and Bluetooth drivers are
> the only ones that are vulnerable to remote access, however. Open Source
> Development Labs Linux evangelist Bill Weinberg says driver exploits are
> also limited by the fact that many of them will simply crash the system.
>
>
> ****************************************************************************
> This message contains confidential information and is intended only
> for the individual or entity named. If you are not the named addressee
> you should not disseminate, distribute or copy this e-mail.
> Please notify the sender immediately by e-mail if you have received
> this e-mail by mistake and delete this e-mail from your system.
> E-mail transmission cannot be guaranteed to be secure or error-free
> as information could be intercepted, corrupted, lost, destroyed, arrive
> late or incomplete, or contain viruses. The sender therefore does not
> accept liability for any errors or omissions in the contents of this
> message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.
> This message is provided for informational purposes and should not
> be construed as an invitation or offer to buy or sell any securities or
> related financial instruments.
> GAM operates in many jurisdictions and is
> regulated or licensed in those jurisdictions as required.
> ****************************************************************************
>
|
|
