🚀 go-pugleaf

John Owens (olorin@access1.digex.net) (<3c5jt7$929@news1.digex.net>) wrote in comp.security.unix:
: In <gburnoreD0EKDn.5Gs@netcom.com>,
: Gary L. Burnore (gburnore@netcom.com) wrote:
: > Ok, so there's a patch available and there's surely been enough time for 
: > it to be implemented.  So what was this "hole"?

: See <8LGM.94Dec5015123@bagpuss.demon.co.uk> for instructions on how
: to get this information; they've put the exploit scripts on their
: fileserver.

: The important point for me, and one I really wished they had posted
: earlier even if they didn't post the exploit script, was that the
: login bug did not allow a user without a valid account to access the
: system, it just let an already-logged-in user create files in
: directories to which they would not otherwise have access (and, if
: they're creative, thereby gain root access).

<snip>
 
    What would be nice would be, instead of a exploit script being posted
initially a - Evaluation and Suggested action - field. Where it evaluates
the risk (such as many known cracks using this hole), and suggests a
solution (chmoding the program, running a wrapper, downing the system,
quick fixes that may detract from the usability of your system, but will
eliminate the risk).