Matthias Andree wrote:
Joerg Schilling <[EMAIL PROTECTED]> writes:
The Linux security bug was that a novice programmer did allow to send
SCSI commands via an fd that has been opened read only!
The adequate bug fix would have been to require opening RW again.
Only to ge
Joerg Schilling <[EMAIL PROTECTED]> writes:
> The Linux security bug was that a novice programmer did allow to send
> SCSI commands via an fd that has been opened read only!
>
> The adequate bug fix would have been to require opening RW again.
Only to get your complaints about users being unable
Bill Davidsen <[EMAIL PROTECTED]> wrote:
> >The onvious fix wouild have been to change the kernel to correctly require
> >write permission on a fd for the SD_IO ioctl.
> >
> >
> Think about that one for a minute... you need to write the "seek" and
> "send data" commands to use the CD at all, at
Bill Davidsen <[EMAIL PROTECTED]> wrote:
> >The Security problem was that the Linux kernel did not check for write
> >permission in order to allow SCSI generic commands to be send.
> >
> >
> Not correct. The problem was that write permission to burn CDs included
> write firmware commands. The i
[EMAIL PROTECTED] wrote:
> > > > > I am looking since quite a while for the particular
> > > > > and substantial security problems which one is said
> > > > > to have if one allows w-access to a CD/DVD writer.
> > > I understand this puts my 60 Euro burner at risk
>
> > Joerg Schilling wrote:
>
Joerg Schilling wrote:
Bill Davidsen <[EMAIL PROTECTED]> wrote:
It seems that you missd the fact that it has been introduced 2 weeks before
cdrtools-2.01-final came out and people on LKML did complain that I did not
cause cdrtools to become unstable from introducing untested code.
Announce
Joerg Schilling wrote:
Bill Davidsen <[EMAIL PROTECTED]> wrote:
It seems that you missd the fact that it has been introduced 2 weeks before
cdrtools-2.01-final came out and people on LKML did complain that I did not
cause cdrtools to become unstable from introducing untested code.
Announce
Hi,
> > > > I wrote:
> > > > I am looking since quite a while for the particular
> > > > and substantial security problems which one is said
> > > > to have if one allows w-access to a CD/DVD writer.
> > I understand this puts my 60 Euro burner at risk
> Joerg Schilling wrote:
> THe bug in the l
Joerg Schilling <[EMAIL PROTECTED]> writes:
>> If "prominent" developer need close interaction with the kernel, they
>> might be well advised in reading LKML regularly. There was for sure a
>> longe time frame between proposal and actual introduction than 2 weeks.
>
> If you check the LKML archive
Joerg Schilling <[EMAIL PROTECTED]> writes:
> [EMAIL PROTECTED] wrote:
>
>> > > I am looking since quite a while for the particular
>> > > and substantial security problems which one is said
>> > > to have if one allows w-access to a CD/DVD writer.
>> > Matthias Andree wrote:
>> > As far as I und
[EMAIL PROTECTED] writes:
> The setuid privileges demand w-rights ?
No, these are independent. Many OSs in fact do not check permissions for
privileged users at all, you can read files even after chmod 0.
> I mean, that is an interesting sneak, but isn't it rather
> related to mount -o user,ex
[EMAIL PROTECTED] wrote:
> > > I am looking since quite a while for the particular
> > > and substantial security problems which one is said
> > > to have if one allows w-access to a CD/DVD writer.
> > Matthias Andree wrote:
> > As far as I understand Jörg, vendor-specific commands are often invo
Hi,
> > I wrote:
> > I am looking since quite a while for the particular
> > and substantial security problems which one is said
> > to have if one allows w-access to a CD/DVD writer.
> Matthias Andree wrote:
> As far as I understand Jörg, vendor-specific commands are often involved
> in CD writi
Norbert Preining <[EMAIL PROTECTED]> wrote:
> On Don, 16 Feb 2006, Joerg Schilling wrote:
> > It seems that you missd the fact that it has been introduced 2 weeks before
> > cdrtools-2.01-final came out and people on LKML did complain that I did not
> > cause cdrtools to become unstable from intro
Bill Davidsen <[EMAIL PROTECTED]> wrote:
> >It seems that you missd the fact that it has been introduced 2 weeks before
> >cdrtools-2.01-final came out and people on LKML did complain that I did not
> >cause cdrtools to become unstable from introducing untested code.
> >
> >Announced (in case of a
[EMAIL PROTECTED] writes:
> Hi,
>
>> This was not a change made because it would be nice, it was made because
>> it became public information that anyone who could burn could change the
>> firmware. Security fixes sometime do have to be done quickly, evil
>> people do tend to jump on any openin
Hi,
> This was not a change made because it would be nice, it was made because
> it became public information that anyone who could burn could change the
> firmware. Security fixes sometime do have to be done quickly, evil
> people do tend to jump on any opening in the time between a
> vulnera
Joerg Schilling wrote:
Bill Davidsen <[EMAIL PROTECTED]> wrote:
Filtering SCSI commands was an unannounced change of the interface
that needs to be called a bug. I still do not see any fix for this.
Unannounced? It was in LKML, it was in the changelog, it was discussed
in multiple
On Don, 16 Feb 2006, Joerg Schilling wrote:
> It seems that you missd the fact that it has been introduced 2 weeks before
> cdrtools-2.01-final came out and people on LKML did complain that I did not
> cause cdrtools to become unstable from introducing untested code.
>
> Announced (in case of an i
Joerg Schilling schrieb am 2006-02-16:
> Bill Davidsen <[EMAIL PROTECTED]> wrote:
>
> > >Filtering SCSI commands was an unannounced change of the interface
> > >that needs to be called a bug. I still do not see any fix for this.
> > >
> >
> > Unannounced? It was in LKML, it was in the changelog,
Bill Davidsen <[EMAIL PROTECTED]> wrote:
> >Filtering SCSI commands was an unannounced change of the interface
> >that needs to be called a bug. I still do not see any fix for this.
> >
>
> Unannounced? It was in LKML, it was in the changelog, it was discussed
> in multiple places, it was in the
Joerg Schilling wrote:
Bill Davidsen <[EMAIL PROTECTED]> wrote:
I have the impression that you are using Linux and Linux definitely
does not fall into this category (since ~ 2001, no SCSI bug I am aware of has
been fixed in Linux). In case of unknown problems, it makes sense to change
thin
[resending to right list]
Joerg Schilling schrieb am 2006-02-13:
> Matthias Andree <[EMAIL PROTECTED]> wrote:
>
> > Joerg Schilling schrieb am 2006-02-13:
> >
> > > Filtering SCSI commands was an unannounced change of the interface
> > > that needs to be called a bug. I still do not see any fix
Matthias Andree <[EMAIL PROTECTED]> wrote:
> Joerg Schilling schrieb am 2006-02-13:
>
> > Bill Davidsen <[EMAIL PROTECTED]> wrote:
> >
> > > >I have the impression that you are using Linux and Linux definitely
> > > >does not fall into this category (since ~ 2001, no SCSI bug I am aware
> > > >
Joerg Schilling schrieb am 2006-02-13:
> Bill Davidsen <[EMAIL PROTECTED]> wrote:
>
> > >I have the impression that you are using Linux and Linux definitely
> > >does not fall into this category (since ~ 2001, no SCSI bug I am aware of
> > >has
> > >been fixed in Linux). In case of unknown prob
Bill Davidsen <[EMAIL PROTECTED]> wrote:
> >I have the impression that you are using Linux and Linux definitely
> >does not fall into this category (since ~ 2001, no SCSI bug I am aware of has
> >been fixed in Linux). In case of unknown problems, it makes sense to change
> >things in order to fi
Matthias Andree <[EMAIL PROTECTED]> wrote:
> Joerg Schilling schrieb am 2006-02-12:
>
> > Putting effort into people who are mot responsive ist a wast of time.
>
> Stimmt. Du antwortest eh nie auf das, was Du gefragt wirst. Warum
> antworte ich Dir überhaupt?
Wir hatten uns doch darauf geeinigt,
Joerg Schilling wrote:
Matthias Andree <[EMAIL PROTECTED]> wrote:
status: 0x2 (CHECK CONDITION)
Sense Bytes: 70 00 04 00 00 00 00 0A 00 00 00 00 08 00 00 00
Sense Key: 0x4 Hardware Error, Segment 0
Sense Code: 0x08 Qual 0x00 (logical unit communication failure) Fru 0x0
Sense flags: Blk 0 (n
Matthias Andree <[EMAIL PROTECTED]> wrote:
> Did you understand my paragraph you quoted?
> I'll take it apart for you:
> 1. I am not interested in your operating systems "known to work",
>and you know as much. Installing OSs may be your hobby, it's not
>one of mine.
> 2. I am not intere
"Alexander Noe'" <[EMAIL PROTECTED]> wrote:
> > Could you tell us what exact problems you did have?
> > Did you see "logical unit communication falure" too?
>
> On both (!) drives, I got logical unit communication failure as well
> as LOGICAL UNIT COMMUNICATION CRC ERROR (ULTRA-DMA/32). When try
Joerg Schilling schrieb am 2006-02-12:
> Putting effort into people who are mot responsive ist a wast of time.
Stimmt. Du antwortest eh nie auf das, was Du gefragt wirst. Warum
antworte ich Dir überhaupt?
> > I haven't seen a list or sample of affected commands, only nebulous
> > "look at XYZ to
Joerg Schilling wrote:
Wasn't there, some time ago, a problem with Linux and DMA transfers
with sizes that were not a power of two? Could you patch growisofs in
order to use like 17 or 23 sectors per transfer and see what happens?
I believe that the problem was only related to size % 512 != 0
"Alexander Noe'" <[EMAIL PROTECTED]> wrote:
> Wasn't there, some time ago, a problem with Linux and DMA transfers
> with sizes that were not a power of two? Could you patch growisofs in
> order to use like 17 or 23 sectors per transfer and see what happens?
I believe that the problem was only r
Matthias Andree <[EMAIL PROTECTED]> wrote:
> I need something to quote to the guys if it turns out to be really a
> Linux bug that has been unfixed for years. In case you need help
> interpreting my post: I'm not ruling out yet that Linux has a bug here
> (and at first glance it seems Linux is th
Alexander Noé schrieb am 2006-02-12:
> Which transfer length does growisofs use? A sector is 2048 bytes, so
> if it uses 16 or 32 sectors per transfer, the transfer size would be a
> power of 2.
This isn't about growisofs but readcd -c2scan.
This is even mentioned in the subject.
> Wasn't ther
Matthias Andree wrote:
Alexander Noé schrieb am 2006-02-11:
Change the UDMA mode to a lower setting and try again. Try a better
IDE cable and try again.
As UDMA/33 works properly for everything else like growisofs reading or
writing a DVD (16X) or such, and FreeBSD (same computer, multi-bo
Joerg Schilling schrieb am 2006-02-12:
> Of course I reported the bug, but you may know that Linux bugs are not
> fixed.
URL or Message-ID?
I need something to quote to the guys if it turns out to be really a
Linux bug that has been unfixed for years. In case you need help
interpreting my post:
Matthias Andree <[EMAIL PROTECTED]> wrote:
> > I have the impression that you are using Linux and Linux definitely
> > does not fall into this category (since ~ 2001, no SCSI bug I am aware of
> > has
> > been fixed in Linux). In case of unknown problems, it makes sense to change
> > things in
Answering three messages in one, to keep the thread concise.
Joerg Schilling schrieb am 2006-02-12:
> Matthias Andree <[EMAIL PROTECTED]> wrote:
>
> > >> status: 0x2 (CHECK CONDITION)
> > >> Sense Bytes: 70 00 04 00 00 00 00 0A 00 00 00 00 08 00 00 00
> > >> Sense Key: 0x4 Hardware Error, Segmen
Matthias Andree <[EMAIL PROTECTED]> wrote:
> > Change the UDMA mode to a lower setting and try again. Try a better
> > IDE cable and try again.
>
> As UDMA/33 works properly for everything else like growisofs reading or
80 or 40 wire cable?
> writing a DVD (16X) or such, and FreeBSD (same compu
"Alexander Noe'" <[EMAIL PROTECTED]> wrote:
> Matthias Andree wrote:
>
> > I'm not interested in "known to work", but as the drive works with
> > FreeBSD 6-STABLE, is there a better way to isolate the problem than
> > running readcd with -v -V -d under strace(1) supervision?
>
> Change the UDMA
Alexander Noé schrieb am 2006-02-11:
> Change the UDMA mode to a lower setting and try again. Try a better
> IDE cable and try again.
As UDMA/33 works properly for everything else like growisofs reading or
writing a DVD (16X) or such, and FreeBSD (same computer, multi-boot)
manages -c2scan just
Matthias Andree <[EMAIL PROTECTED]> wrote:
> >> status: 0x2 (CHECK CONDITION)
> >> Sense Bytes: 70 00 04 00 00 00 00 0A 00 00 00 00 08 00 00 00
> >> Sense Key: 0x4 Hardware Error, Segment 0
> >> Sense Code: 0x08 Qual 0x00 (logical unit communication failure) Fru 0x0
> >> Sense flags: Blk 0 (not va
Matthias Andree wrote:
> I'm not interested in "known to work", but as the drive works with
> FreeBSD 6-STABLE, is there a better way to isolate the problem than
> running readcd with -v -V -d under strace(1) supervision?
Change the UDMA mode to a lower setting and try again. Try a better
IDE c
Joerg Schilling <[EMAIL PROTECTED]> writes:
>> readcd: Success. read_cd: scsi sendcmd: no error
>> CDB: BE 00 00 00 00 31 00 00 31 FA 00 00
>> status: 0x2 (CHECK CONDITION)
>> Sense Bytes: 70 00 04 00 00 00 00 0A 00 00 00 00 08 00 00 00
>> Sense Key: 0x4 Hardware Error, Segment 0
>> Sense Code: 0
Matthias Andree <[EMAIL PROTECTED]> wrote:
> Greeting,
>
> running a C2 scan on an audio CD in a NEC ND-4550A (FW rev. 1.07) causes
> errors like these, where a C2 scan of the same CD in a Plextor
> PX-W4824TA (FW rev. 1.06) on the same ATA cable succeeds.
>
> Read speed: 7056 kB/s (CD 40x, DVD
Greeting,
running a C2 scan on an audio CD in a NEC ND-4550A (FW rev. 1.07) causes
errors like these, where a C2 scan of the same CD in a Plextor
PX-W4824TA (FW rev. 1.06) on the same ATA cable succeeds.
Read speed: 7056 kB/s (CD 40x, DVD 5x).
Write speed: 2822 kB/s (CD 16x, DVD 2x).
Capac
47 matches
Mail list logo
