🚀 go-pugleaf

In <gburnoreD0EKDn.5Gs@netcom.com>,
Gary L. Burnore (gburnore@netcom.com) wrote:
> Ok, so there's a patch available and there's surely been enough time for 
> it to be implemented.  So what was this "hole"?

See <8LGM.94Dec5015123@bagpuss.demon.co.uk> for instructions on how
to get this information; they've put the exploit scripts on their
fileserver.

The important point for me, and one I really wished they had posted
earlier even if they didn't post the exploit script, was that the
login bug did not allow a user without a valid account to access the
system, it just let an already-logged-in user create files in
directories to which they would not otherwise have access (and, if
they're creative, thereby gain root access).

On the disclosure question, I'm definitely in favor of full
disclosure.  Even before fixes are available, it lets us decide what
the risks to our systems are, and how best to deal with them.  It's
also useful for other purposes; knowing what the SCO holes were, I
made sure that they could not be exploited by a security-related
program I was in the process of writing.  If I hadn't had that
information, it might not have occurred to me to protect against
these attacks.

	-John

--
John Owens        john@micros.com        olorin@access.digex.net
http://access.digex.net/~olorin, or see .plan for PGP public key
------- Technical advisor - Wednesday's Coterie of Thugs -------