[gentoo-security] Re: No, apparently not. (was: Is anybody else worried about this?)

[Peter Simons]

Kurt Lieber writes:

 > Perhaps you haven't done a good job of educating us, then.

Then I'll explain it one last time.

The entire contents of /usr/portage is not authenticated.
All the manifest files, all the patches, all the ebuilds are
obtained through a public network without _any_ form of
authentication.

This means that the wonderful SSP/PIE patches for gcc, the
SELinux kernel, the PaX additions, the digest-checking for
upstream packages -- it is all completely worthless, because
after you have performed an "emerge sync" you have no idea
what your system does.

Anybody who has access to a mildly central router or domain
name server in the Internet can take your machine over
completely without any effort at all. And as it happens,
there is (a) no way for the user to remedy this situation,
there is (b) no way to recognize this has happened, and (c)
the vulnerability has been known for over 1.5 years.

Does that make it any clearer why this problem might be
worth being solved, like, soon?

Peter


--
gentoo-security@g.o mailing list