🚀 go-pugleaf

In article <LEE.94Nov30001236@netspace.students.brown.edu>,
lee@netspace.students.brown.edu (Lee Silverman) wrote:
> 
> 	Just to be annoyingly anal about this, the 8glm advisory said
> that the problem was with "login".  So the smart thing to do is
> disable programs and protocols that call login: telnetd, rlogind,
> rshd, and if you don't have a secure console, getty or whetever it is
> on SCO boxes that manages console terminals.  Your Web, ftp, News, etc
> services don't need to be taken offline because of a bug in login.

While this may seem perfectly obvious to you and I, not all sysadmins
are intimately familiar with the internals of TCP/IP and inetd.conf.
If your suggestion would indeed have prevented security from being
breached then it should DEFINITELY have been explained in that same
warning about the hole.

> 	That aside, I'm still on the fence about the full disclosure
> bit.  Right now I'm in favor of full disclosure, so that the problem
> can be fixed as soon as possible.  

IMHO, if there is no readily available workaround, then full disclosure
is bad. But there must be plenty of experts available for private
consultation on these matters so that the announcements could be
delayed for a few hours while a workaround is prepared and documented.

---------------------------------------------------------------------
Cool cats, brick bats, bad boys wearin' big hats
Surf's up, my cup, floating, flying, rising up.

Michael Dillon                    mpdillon@halcyon.com
C-4 Powerhouse, RR #2             michael@junction.net
Armstrong, BC   V0E 1B0           Fido: 1:353/350
Canada                             BBS: +1-604-546-2705