What is Digg?Sponsored by Dragon Age: Origins
See the new YouTube feature trailer for Dragon Age: Origins view!
youtube.com/DragonAge - EA presents BioWare's new dark fantasy epic Dragon Age: Origins. '9/10' from Game Informer.
70 Comments
- Phocion55, on 10/11/2007, -4/+63BREAKING: Amazing [Pics] Samsung Driver Install Hacks Ubuntu!!!!!!!!!!!
would me more Digg-appropriate - ObsidianParis, on 10/11/2007, -1/+47Your title just ain't catchy enough. Everybody thinks that it's just about another common security flaw or a side effect, while it's actually a deliberate way of coding to surround a leak in the design itself.
Not only the guy who wrote this is visibly used to turn everything into Administrator under Windows as well, but also seems not to know what a multi-user environment is, nor realizing that setting set[ug]id bits is switching the user identity, not inherently granting powers.
Shame on him. Maybe he's a student, a trainee, or maybe Samsung estimates that the Unix market is not worth hiring skilled developers on it. Will they realize that such an issue could taint the entire brand name for a while ? - Dankoozy, on 10/11/2007, -1/+34So with that driver installed, any user can just whip up a new text document and save as /etc/shadow?
- jellygraph, on 10/11/2007, -2/+34this is what happens when you let loose windows developers on a unix system... gross
- AK10, on 10/11/2007, -5/+36Maybe this is why Windows is so ***** up, we let big corporations who don't give a ***** about security write software for it.
- stmiller, on 10/11/2007, -0/+21Ha! I don't know if I should laugh or throw up. That is the sad truth on this website. *sigh*
- fylb, on 10/11/2007, -0/+16Translation :
In the sources of the installation script, you can see:
wrap_setuid_third_party_application xsane
wrap_setuid_third_party_application xscanimage
wrap_setuid_ooo_application soffice
wrap_setuid_ooo_application swriter
wrap_setuid_ooo_application simpress
wrap_setuid_ooo_application scalc
and :
wrap_setuid_third_party_application() {
if echo "$1" | grep -q "/" ; then
APP_NAME=$1
else
APP_NAME=`which $1 2> /dev/null`
fi
NEW_NAME=${APP_NAME}.bin
if test -n "$APP_NAME" ; then
if ! test -f "$NEW_NAME" && ! test -d "$NEW_NAME"; then
mv "$APP_NAME" "$NEW_NAME"
cp -af /opt/${VENDOR}/mfp/bin/suwrap "$APP_NAME"
chown root:root "$APP_NAME"
chmod 4755 "$APP_NAME"
fi
fi
}
wrap_setuid_ooo_application() {
WRAPPING_BIN=`ls /usr/lib*/*/program/$1.bin /opt/*/program/$1.bin 2> /de
v/null | head -1`
if test -n "$WRAPPING_BIN" ; then
${2}wrap_setuid_third_party_application $WRAPPING_BIN
fi
}
To sum up, the script copies the ooo executables into /opt with a .bin extension and then replaces them with a setuid script which call them. I have never seen such a piece of crap. - daftman, on 10/11/2007, -0/+14No, I'm not grateful when the Pope visits my house and decide to burn it.
If you are going to do something, then do it properly. Otherwise, leave it up to others to do it.
May be you should learn to stop worship the ground that every corporation walks on. - autoatsakiklis, on 10/11/2007, -1/+15I other words: "Samsung releases rootkit"
- epileet, on 10/11/2007, -0/+13im amazed somebody could write a printer driver and yet not know what root is
- multitude, on 10/11/2007, -0/+11I will never buy Samsung again after reading this. I bought one printer from them previously and while I didn't use it on Linux, even their Mac OS X drivers were horrible. This has made me conclude that their products aren't worth my time or money. Thanks for posting this!
- lordkenthegreat, on 10/11/2007, -3/+12Yep. And open up /etc/shadow and /etc/passwd and copy it to a text file.
- thunderbee, on 10/11/2007, -1/+9Quick translation:
"In the drivers's installation script you can see":
[first code block]
"and"
[second code block]
"Basically it copies the ooo binaries in /opt with a .bin extension and replaces them with a suid script that calls them. I have never seen such horror". - m4k3r, on 10/11/2007, -1/+9@hackerssidekick
Those who don't know the difference between /etc/passwd and /etc/shadow are unworthy of being a hackers side kick.
Hand your geek card in at the door, leave quietly, and don't come back. - baalzebub, on 10/11/2007, -1/+9thanks for the info, i will be sure to NOT buy any Samsung products or use any software from SamSung...
- KibibyteBrain, on 10/11/2007, -0/+7This is why I highly recommend Linux users try to manually install drivers and stuff for printers and peripherals even if they come with a automagical disk. In fact, for corporate print servers and such, I actually recommend using Xen to run several different virtual servers to drive peripherals so as to stop any of these crazy drivers from messing up your server.(also, VMs are nice for serving windows-only printers and stuff)
- inactive, on 10/11/2007, -2/+9I guess they really wanted to port the closest possible Windows drivers to Linux.
- moghua, on 10/11/2007, -0/+7I've bought a few Samsung printers in the past for use with my Linux boxes, but I've never needed to use the drivers they supply, I just configure the printer via cups and it works great.
- IncognitoCraven, on 10/11/2007, -1/+8In addition to the setuid/chown wrapper tom-foolery, it seems it also (elsewhere) chown's /etc!
- jbus, on 10/11/2007, -0/+7Thanks for the info... Welcome to my ***** list Samsung.
- iapx, on 10/11/2007, -2/+8Interesting to have Samsung put a huge security hole in ANY Linux Desktop that had access, have access (or plan to) to it's printer.
That means that every company that own (or owned) a single samsung printer, and use Linux desktops, is probably targetable by hackers. (and probably will)
What could Samsung loose if all these companies begin to sue and claim for damage? - Amablue, on 10/11/2007, -3/+9I'm sorry, I don't play Pokemon
- msgyrd, on 10/11/2007, -1/+6You missed the joke.
- RockyRoad29, on 10/11/2007, -1/+6I would translate the message from hdiamant,
timestamped: #4 Le 12/07/2007, à 18:39
--
Re: [SOLVED] Ooo launched as root while I'm logged as normal user
Then here's the solution : it is a huge security hole related to the installation
of Unified Linux Drivers (especially my scx-4200).
To correct this, you'll have to *comment out* the following lines in the installation script:
wrap_setuid_third_party_application xsane
wrap_setuid_third_party_application xscanimage
wrap_setuid_ooo_application soffice
wrap_setuid_ooo_application swriter
wrap_setuid_ooo_application simpress
wrap_setuid_ooo_application scalc
--
and
--
wrap_setuid_third_party_application() {
if echo "$1" | grep -q "/" ; then
APP_NAME=$1
else
APP_NAME=`which $1 2> /dev/null`
fi
NEW_NAME=${APP_NAME}.bin
if test -n "$APP_NAME" ; then
if ! test -f "$NEW_NAME" && ! test -d "$NEW_NAME"; then
mv "$APP_NAME" "$NEW_NAME"
cp -af /opt/${VENDOR}/mfp/bin/suwrap "$APP_NAME"
chown root:root "$APP_NAME"
chmod 4755 "$APP_NAME"
fi
fi
}
wrap_setuid_ooo_application() {
WRAPPING_BIN=`ls /usr/lib*/*/program/$1.bin /opt/*/program/$1.bin 2> /dev/null | head -1`
if test -n "$WRAPPING_BIN" ; then
${2}wrap_setuid_third_party_application $WRAPPING_BIN
fi
}
--
They are an aberration.
In order to use the scanner, you need to apply the solution given here:
http://jacobo.tarrio.org/Samsung_SCX-4200_on_Debian
!!! WARNING !!! the installation script changes the owner of /etc .
So you need to do, after drivers are installed:
sudo chown root -R /etc
To have xsane functionnal, you'll have to reboot.
--
HTH - JonForTheWin, on 10/11/2007, -0/+4It's exactly why. It's bad enough that microsoft's system is so terrible but on top of it microsoft allows (and encourages) developers ("developers") to distribute packages as binaries. A recipe for a disaster. It's why a printer driver (that is only compatible with THAT printer) ends up being 60+mb.
- maz2331, on 10/11/2007, -0/+4Wow - what a hideous installation. It does totally validate the concerns regarding binary drivers in open source OSs. Personally, I tend to build stuff from source as much as possible, but normally wouldn't think of looking for this type of a hack.
If there's no native driver available in source form for a printer to be used with any *nix box I control, then I install a postscript driver on it and use "redmon" on a Windows box to run the real driver. Just configure CUPS to turn print job into PS, then send it to a virtual printer created with Redmon that prints the PS to the printer via its proprietary driver. Best of both worlds, since I expect the Windows box to be insecure.
It's not too difficult to set up, but you do need a Win box (or maybe Win running in a VM) to do it. - ObsidianParis, on 10/11/2007, -1/+5Would have been the title I was looking for on top of the thread ;-)
- ObsidianParis, on 10/11/2007, -1/+4Actually, I got it but I let myself overwhelmed by the dire consequences :-)
- ObsidianParis, on 10/11/2007, -0/+3I personally have. I wrote a piece of comment here : http://forum.ubuntu-fr.org/viewtopic.php?id=133574&p=2
A simple look at the user instructions given on the driver web page let me think so. Sorry, still in French. I'll translate it later when I have the time.
Still, not everything has to be trashed in this soft, and Samsung has already done much better in the past. But even with the best intentions, it remains clear that many people are trying to export a mental model from Windows, such as classifying users, finding "My Computer", and so, taking all of this as computer fundamentals, just because they never had the chance to see something different (or simply older).
In particular, very few people have the idea to manage file rights, while it's actually the basics of the UNIX concept.
Last time, still on linuxfr.org, we had to answer a guy who wanted to disable the root password ... because he was fed up of entering it each time he wanted to run gproftpd ! Which also means that he planned to run a FTP server on a machine with no root password.
The truth is that whatever the efforts made on the Windows side, one often has to turn himself into Administrator if he wants to do some tech management stuff. It remains very difficult to get temporary privileges or setup custom rights on resources. - martalli, on 10/11/2007, -0/+3Not me...I was saying "I'll never need this" in German class because I was too lame to be able to say it in German. =)
- BigJ27, on 10/11/2007, -1/+4@hackersidekick:
ls -l /etc/passwd:
-rw-r--r-- 1 root root 1355 2007-06-02 12:00 /etc/passwd - maz2331, on 10/11/2007, -2/+4Buried for irrelevance.
- MasteRR, on 10/11/2007, -0/+2"It does totally validate the concerns regarding binary drivers in open source OSs"
It also validates the concert regarding binary drivers on proprietary OS's as well. Who knows if their OSX and Windows drivers are this bad as well. - venom8599, on 10/11/2007, -3/+5Is there a source that's in English instead of French?
- OneAndOnlySnob, on 10/11/2007, -0/+2*VOMIT*
- ObsidianParis, on 10/11/2007, -3/+5Well, it doesn't simply stick to Ubuntu ! This would affect every UNIX system. It's really amazing indeed.
Also, the title is incomplete as it claims that this driver modifies the executable rights. It does much more than this : it copies the binaries of some arbitrary chosen applications into /opt, rename them by adding a ".bin" suffix, then install a self-made setuied binary executable at their places !
Nobody knows what's inside these binaries, this completely breaks the package system, applications are silently moved into "/opt" thanks to an harcoded script, and so on ...
The Windows integration is probably as bad as this one. Freaky ! - Pepper, on 10/11/2007, -0/+1ls -l /etc/passwd: -rw-r--r-- 1 root root 1395 2007-07-14 21:46 /etc/passwd
ls -l /etc/shadow: -rw-r----- 1 root shadow 849 2007-07-14 21:46 /etc/shadow - rusty0101, on 10/11/2007, -0/+1The Samsung hardware itself is mostly fine. It's the stupidity of the drivers developers that creates the problems.
If your printer is supported, you will get better results from the splix driver than I have seen out of the Samsung drivers for the same printers. Those drivers support both my color laser printer and my black and white laser printer better than the manufacturer's drivers. How 'better'? Well both printers will only do 600x600 with the Samsung drivers, and both will do 1200x1200 with the splix drivers. Or you could use the CLP-???N series printers which have both networking and postscript built right in.
For a low volume laser printer that does fairly good quality color, I'm happy. Won't say you will be though. - slithy, on 10/11/2007, -0/+1FAIL...again
/etc/passwd is readable, /etc/shadow is not - ObsidianParis, on 10/11/2007, -1/+2I subscribe on your point of view. Even though the developer exactly knew what he did, it's not a deliberate will from Samsung to release a crapy driver (I hope it's not). Also, I believe that the whole driver hasn't been written by a single guy. Binaries have probably been produced by many members of a team, basing on the work that already have been done for Windows drivers. The shell wrapper is a final step and they probably have charged a newbie to do it. It might be also a guy specialized in the Windows development that wasn't good at this in particular.
In a recent past, Samsung has already been cheered for opening their Flash device drivers : http://technocrat.net/d/2006/2/28/1015
Let's give them a chance to fix this issue AND REPAIR THE DAMAGES ALREADY DONE before dropping them into our blacklist (update: letting them repair the damage might be worst, ok). - FKnight, on 10/11/2007, -0/+1No, because it wouldn't have been able to ***** with any system files. Do you bash Vista because it's cool to do so?
- ObsidianParis, on 10/11/2007, -1/+2That's the point of the thing: as you have installed the driver, OpenOffice and some other softs are automatically run as root !
- urgan, on 10/11/2007, -0/+1Some do, some are crap and do not even understand PCL-4 correctly. I've bought two so far and both had it's own modified lprng and wanted to put config files spread all over. HP for cups, and small samsung laser for workstations.
- maz2331, on 10/11/2007, -0/+1When in doubt, assume the worst until proven otherwise.
- FKnight, on 10/11/2007, -0/+1So are all the comments that bash Windows because a printer vendor wrote bad Linux drivers. Did you bury those too?
- benanzo, on 10/11/2007, -1/+1Is this because the ***** dev couldn't figure out how to let non-priviledged users access his printer driver? Is he retarded? This is hilarious. So instead of solving the problem, he just replaces the executables for every app that can print with a setuid root script. I love it when Windows devs try to code for Linux/UNIX. They immediately realize how stupid they are when the community throws it in their face.
- LaneLester, on 11/13/2007, -0/+0I, too, have been using the available CUPS drivers, but I've never gotten completely satisfactory results. I have an ML-2151N and either can't get all the duplex options or I can't switch between portrait and landscape. Of course, the Windows driver does everything right. Grrrr. Anyway, do you have a recommendation about a good driver for this thing?
- Samurailink3, on 10/11/2007, -1/+1Dugg you for XKCD Reference
- JonForTheWin, on 10/11/2007, -1/+1'cause anything Samsung does to it would be considered repair; vista is already so *****.
-
Show 51 - 71 of 71 discussions
Browsing Digg on your phone just got easier with our enhancements to the 
© Digg Inc. 2009
— Content created and posted by Digg users is