None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
Our `sudo` configuration is now generated from a higher-level description,
which has safer defaults and demands explanations when diverging
from them.
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
Postmortem of OTF-003 ([[!tails_ticket 20711]] and [[!tails_mr 1979]])
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
Our CI now ensures that all our custom Python software runs in
isolated mode.
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
Postmortem of OTF-002 ([[!tails_ticket 20719]] and [[!tails_mr 1911]])
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
for potentially vulnerable Mite code and fail the build if we find any.
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
[[!tails_gitweb config/chroot_local-hooks/99-zzz_check_mite desc="automatically check"]]
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
Furthermore, we now
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
While preparing a major Tails release based on a new version of Debian, for example, Tails 7.0,
we will look for Perl code included in Tails
that modifies `@INC` in a dangerous way. ([[!tails_ticket 19627]])
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
Postmortem of OTF-001
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
Technical improvements
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
This analysis was useful and we'll definitely consider doing postmortems again after future audits. It might also be useful for other projects to understand how we worked on these long-lasting improvements.
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
Our team went further than simply fixing these issues. We conducted a *postmortem* to understand *how* we introduced these vulnerabilities in our releases and *what* we could do to avoid similar vulnerabilities in the future. This analysis led to technical, policy, and culture changes.
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
Postmortem
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
<table>
<tr><th>ID</th><th>Impact</th><th>Description</th><th>Issue</th><th>Status</th><th>Release</th></tr>
<tr><td>OTF-001</td><td>High</td><td>Local privilege escalation in <i>Tails Upgrader</i></td><td>[[!tails_ticket 20701]]</td><td>Fixed</td><td>6.11</td></tr>
<tr><td>OTF-002</td><td>High</td><td>Arbitrary code execution in Python scripts</td><td>[[!tails_ticket 20702]]</td><td>Fixed</td><td>6.11</td></tr>
<tr><td> </td><td></td><td></td><td>[[!tails_ticket 20744]]</td><td>Fixed</td><td>6.12</td></tr>
<tr><td>OTF-003</td><td>Moderate</td><td>Argument injection in privileged GNOME scripts</td><td>[[!tails_ticket 20709]]</td><td>Fixed</td><td>6.11</td></tr>
<tr><td> </td><td></td><td></td><td>[[!tails_ticket 20710]]</td><td>Fixed</td><td>6.11</td></tr>
<tr><td>OTF-004</td><td>Low</td><td>Untrusted search path in Tor Browser launcher</td><td>[[!tails_ticket 20733]]</td><td>Fixed</td><td>6.12</td></tr>
</table>
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
The auditors found 4 issues in:
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
The creation of the Persistent Storage with LUKS2, introduced in [[Tails 5.14|version_5.14]] (June 2023)
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
The auditors did not identify any vulnerability in:
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
Findings
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
> The Tails operating system leaves a strong security impression, addressing
> most anonymity-related concerns. We did not find any remote code execution
> vulnerabilities, and all identified issues required a compromised
> low-privileged `amnesia` user &ndash; the default user in Tails.
>
> Looking back at the [[previous audit|audit_by_ROS]], we can see the Tails
> developers have made significant progress, demonstrating expertise and a
> serious commitment to security.
 
a month ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. German
The auditors concluded that:
 
a month ago

Search