2

How do I manually patch security bugs safely without damaging the system for information security purposes on my Ubuntu system that I am running on one of my mobile computers? I need to find packages for armel only. I am running Ubuntu 10.04 LTS.

Here is my research into how I can manually patch security bugs:

Make list of all security bugs from Ubuntu security notice website and write down name of packages to download and install for armel manually in the terminal.

Find all necessary dependencies and write out an organized plan to safely install proper dependencies as it may damage the outdated system since backtrack 5 is basically Ubuntu 10.04.

Manually patch the basics such as the openssl heartbleed bug with the new openssl and manually patch the glibc bug with the newer package for armel by simply downloading the packages and manually installing them on the terminal.

I must be able to run this outdated version of Ubuntu 10.04 LTS on my device since my kernel is outdated so is this the safest route?

  • 1
    This implies that your testing is as in depth as the whole Ubuntu community testing of the current version. If you don't have the same installation, they may not find bugs that only touch yours. It is simply a very bad idea to stick to an unsupported OS. – Julie Pelletier Jun 27 '16 at 4:16
  • That will still put you in the same situation. You'll be the only one in the world testing your custom changes. Is your time worth so little? Even if you do it for the experience, you can be sure not to get hired if you mention this. – Julie Pelletier Jun 27 '16 at 4:22
  • Ubuntu won't publish a discovered security flaw if it only occurs in old versions. So you'll be susceptible to all of those flaws as you'll never know about them – Neil Smithline Jun 27 '16 at 4:27
  • 2
    Travis, I think that @JuliePelletier has answered your question. It's not safe. You saying you have no choice doesn't change the answer to your question. Perhaps you want to reword your question to say that you must run this OS and ask if this is the safest that you can be given your limited resources – Neil Smithline Jun 27 '16 at 4:30
  • You can use Ubuntu package manager to upgrade everything including kernel. I would suggest cloning the hard drive to another then doing a full upgrade. If anything goes wrong just revert to the clone copy. – cybernard Jun 10 '17 at 3:12
3

It is better to try to manually patch serious security bugs than doing nothing, but it will be terribly hard to close everything. That's why we use distribs. There are teams of maintainers that keeps staying informed on security threats, look whether they can apply to their code and then either patch or upgrade.

The problem when you use a no longer maintained code, is that nobody will do the low level work of analyzing the code to see if a threat applies. If you see that a threat applies to a more recent version than yours, it will likely apply to yours. But if you see no alert on the recent version, it does not mean that yours is not vulnerable. That specially applies to system code like kernel and x11.

If the problem is about resources, Linux systems can be stripped down. For example, if you system can not run the last Unity version, you could try lubuntu that only uses lxde of xubuntu that uses xfce, both being far less ressource consuming.

TL/DR: as security is a whole, you's better try to upgrade your system, even if you need a stripped down version of ubuntu. If you don't you are likely to leave open security bugs on an unmaintained piece of code.

6

I've been maintaining a private fork of a CMS for approx. 7 years. The initial release had some serious security issues which did not get fixed properly by the original vendor in time. This is why I have fixed it myself and this is where I have lost the compatibility to most of the original patches/upgrades.

This is possible, it takes a lot of time. And it might make sense if you want to do this for a limited amount of time - For example to prepare a solid substitution of an outdated environment. But if you are thinking about supporting the old platform for infinity, you are going to die old, angry and sad.

0

There are several flaws in your procedure.

Ubuntu only monitors issues that are relevant for the software versions included in supported releases. If an issue is discovered that affects software in 10.04 but not in any of the currently supported releases, they won't pay attention to it, so your system will remain vulnerable.

Fixing issues by installing the latest version of software will not work most of the time because the latest version tends to require the latest version of other software, which requires the latest version of yet other software, and so on. Managing dependencies is a huge job, it takes thousands of people (part-time, but still) to do it across Debian and Ubuntu.

I suggest that you try running a supported version of Ubuntu on top of an outdated kernel. Maybe not the latest one to keep the gap low. This may or may not work, but core kernel functionality is relatively stable, so most features should work.

The best solution would of course be to port the unmaintained drivers that you need to a recent kernel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.