Upside: OpenBSD plugs a rare security leakOct 06, 2000, 22:59 (0 Talkback[s])
(Other stories by Sam Williams)
"For most open source projects, news of an overlooked security hole is simply part of the debugging process. But for the developers of OpenBSD, an operating system whose design motto is "secure by default," it's nothing short of an affront."
"Back in June, when a "malicious character string" vulnerability was discovered in an open source IRC (Internet Relay Chat) client, OpenBSD developers opted for the blitzkrieg approach and were already performing a full, pre-emptive source tree audit before crackers had time to figure out ways to exploit the vulnerability."
"We fixed dozens if not over a hundred of format string vulnerabilities," says Aaron Campbell, an OpenBSD developer. "At the time, no exploits for format string problems were available. It was easy to crash programs, but methods for gaining elevated privileges were not publicly known and at the time it was largely theoretical."