🚀 go-pugleaf

In article <8LGM.94Nov28004011@bagpuss.demon.co.uk>,
	[8LGM] Security Team <8lgm@bagpuss.demon.co.uk> wrote:

>PROGRAM:	login(1)
>VERSION:	SCO UNIX 3.2v4.2
>IMPACT:	Any user on the system can become root.
>FIX:		Obtain patch from your vendor.


Boy, this one was really helpful. Maybe I should just disable the
"login" command until a patch becomes available, huh?

MD
-- 
-- $  cat << 'msg_eof' | mail president@whitehouse.gov
-- hahaha.
-- msg_eof

In <3bbrjo$ot@cat.cis.Brown.EDU> md@pstc3.pstc.brown.edu (Michael P. Deignan) writes:

>Boy, this one was really helpful. Maybe I should just disable the
>"login" command until a patch becomes available, huh?

If someone breaks root at your site, at least you will have some clue as to 
how it was done, right ?

Still better than staying totally in the dark isn't it ?

In case you don't remember : This is the way people on c.s.* wanted things done.


_________________________________________________________________
| Rikhardur Egilsson    | I come from the land of Ice and snow  | 
| rikardur@rhi.hi.is    | with the midnight sun and where the   |
| TF3RET                |          hot streams flow.            |
-----------------------------------------------------------------

In article <3bca3q$6dh@eldborg.rhi.hi.is> 
rikardur@rhi.hi.is (Rikhardur Egilsson) writes:
: 
: >Boy, this one was really helpful. Maybe I should just disable the
: >"login" command until a patch becomes available, huh?
: 
: If someone breaks root at your site, at least you will have some clue as to 
: how it was done, right ?
: 
: Still better than staying totally in the dark isn't it ?
: 
: In case you don't remember : This is the way people on 
: c.s.* wanted things done.

Since when ?

-Bjorn
 
--
106 396 80 35 340 arc 106 396 lineto closepath 106 496 fill
/Times-Roman 43 selectfont 130 385 moveto (borud@pvv.unit.no) show 130
440 10 0 360 arc 1.0 setgray 150 430 fill 142 455 moveto 120 465
lineto stroke showpage %% 1 minute of PostScript...

In article <3bca3q$6dh@eldborg.rhi.hi.is>,
Rikhardur Egilsson <rikardur@rhi.hi.is> wrote:
| In <3bbrjo$ot@cat.cis.Brown.EDU> md@pstc3.pstc.brown.edu (Michael P. Deignan) writes:
| 
| >Boy, this one was really helpful. Maybe I should just disable the
| >"login" command until a patch becomes available, huh?
| 
| If someone breaks root at your site, at least you will have some clue as to 
| how it was done, right ?

No!

This gives me absolutely no help in determining where the problem lies,
how it can be utilized, what conditions open my system to attack (do
wrappers protect me?, does the intruder need a regular login as well?)
or anything else useful.

And my solution has had to be "take the SCO boxes off the net." Since I
have no information on the magnitude of the hole or how to fix it, or if
it requires other conditions other than the login program being present.

This "security by obscurity" policy is a crock; I've been helping keep
business systems secure for over 25 years, and full disclosure has
always been best, allowing the system administrators to understand and
evaluate the problems for their own machines. This "we won't tell you
what the problems is, but there is one, and the vendor will tell you
when it's fixed, but you won't be able to test it because the problem is
a SECRET only the few are allowed to know" policy translates to the
crackers having the info on their mailing lists and BBS's, while
legitimate system owners are in the dark.
-- 
Bill Davidsen (davidsen@tmr.com) UNIX Codger
	Will solve problems for money.
Stupidity, like virtue, is its own reward.

In article <8LGM.94Nov28004011@bagpuss.demon.co.uk>,
	8lgm@bagpuss.demon.co.uk ([8LGM] Security Team) writes: <paraphrased>

> PROGRAM: 	chocolate_fireguard(1)
> VERSION:	SCO UNIX 3.2v4.2
> IMPACT:	Any user on the system can become root.
> REPEAT BY:	Logging in. Exploit details are available from any teenage hacker.
> FIX:		Obtain patch from your vendor.

...so the only serious security loophole we have is, er, login(1) . Hmmm...

-- 
	"Tough on Capitalism, and tough on the causes of Capitalism."

A little bird told me that bill davidsen (davidsen@tmr.com) wrote:
>
> This gives me absolutely no help in determining where the problem lies,
> how it can be utilized, what conditions open my system to attack (do
> wrappers protect me?, does the intruder need a regular login as well?)
> or anything else useful.

This is a valid point.

> This "security by obscurity" policy is a crock; I've been helping keep
> business systems secure for over 25 years, and full disclosure has
> always been best, allowing the system administrators to understand and
> evaluate the problems for their own machines. This "we won't tell you
> what the problems is, but there is one, and the vendor will tell you
> when it's fixed, but you won't be able to test it because the problem is
> a SECRET only the few are allowed to know" policy translates to the
> crackers having the info on their mailing lists and BBS's, while
> legitimate system owners are in the dark.

This, IMHO, is not.  So your solution is to give every two-bit idiot
that doesn't have the brains to be a cracker, but enough brains to read
and be dangerous a sure-fire way of becoming 'root' on your system?  How
many crackers do you think there are in the world?  How many cracker-
wannabe's are there?  I'll bet you everything I own that the second group
is larger than the first.

And, not everyone who would be tempted to try this trick to login as 'root' 
is subscribed to mailing lists and/or BBS's.  There are quite a few
people in the world, however, that would be more than happy to try something
like this if they were handed the solution on a silver platter, whether
or not they have had any incliniations or desires to becoming a cracker
in the first place.


Cheers,
-+JLS

-- 
                    "The best way out is always through."
                              --Robert Frost

seagull@netcom.com                                     seagull@jg.cso.uiuc.edu

seagull@netcom.com (Seagull) writes:
>This, IMHO, is not.  So your solution is to give every two-bit idiot
>that doesn't have the brains to be a cracker, but enough brains to read
>and be dangerous a sure-fire way of becoming 'root' on your system?  How
>many crackers do you think there are in the world?  How many cracker-
>wannabe's are there?  I'll bet you everything I own that the second group
>is larger than the first.

Who gives a damn?

We had a cracker-wannabe peg us with one of 8LGM scripts, because I
thought I had closed that hole when I hadn't.

But he was easier to track (not being very adept at covering his tracks)
than a serious cracker, and we were able to close the hole.  If there
hadn't been an exploit script or explicit description of the problem
around somewhere, I wouldn't have even known about the problem, and
while we may not have had to deal with this wannabe, we probably WOULD
have had to deal with someone exploiting something we didn't even
understand or know about.  I was extremely relieved when the guy
said that he'd just run this script that exploited that hole, because
I *knew what he was talking about* and I also knew I could fix it simply.

I want to know the holes, and get them closed.

I don't want to be kept in the dark with bullshit like "exploit scripts
withheld until a patch is available".  I'm sad to see 8lgm reduced to
nearly worthless information now.  I have 4 or 5 advisories from them
recently that seem important, but I have no way to verify and no time
to spend digging them up myself, so we're probably going to end up
vulnerable until someone who *isn't* just a wannaby and doesn't rely on
such obscurity riddled methods of communication comes along and kicks us
over.  That's even more of a waste of my time than being told in advance
what the problem is and usually being able to patch it up before the
wannabes get very far with it.
-- 
Pete Hartman		       Bradley University	pwh@bradley.bradley.edu
 I fear we have not gotten rid of "God" because we still have faith in grammar

In article <3bdgml$ana@usenety1.news.prodigy.com>,
davidsen@tmr.com (bill davidsen) wrote:
> 
> This "security by obscurity" policy is a crock; I've been helping keep
> business systems secure for over 25 years, and full disclosure has
> always been best, allowing the system administrators to understand and
> evaluate the problems for their own machines. This "we won't tell you
> what the problems is, but there is one, and the vendor will tell you
> when it's fixed, but you won't be able to test it because the problem is
> a SECRET only the few are allowed to know" policy translates to the
> crackers having the info on their mailing lists and BBS's, while
> legitimate system owners are in the dark.

You have made an eloquent case why sysadmins should monitor
cracker mailing lists, newsgroups, newsletters, BBSes, etc...

---------------------------------------------------------------------
"How to Make a FORTUNE on the Information Superhighway"
This book is written by two lawyers who can't even spell `libel.'

Michael Dillon                    mpdillon@halcyon.com
C-4 Powerhouse, RR #2             michael@junction.net
Armstrong, BC   V0E 1B0           Fido: 1:353/350
Canada                             BBS: +1-604-546-2705

In article <Czzx9J.2wK@dcs.ed.ac.uk> timh@dcs.ed.ac.uk (Tim Heap) writes:
>In article <8LGM.94Nov28004011@bagpuss.demon.co.uk>,
>	8lgm@bagpuss.demon.co.uk ([8LGM] Security Team) writes: <paraphrased>
>
>> PROGRAM: 	chocolate_fireguard(1)
>> VERSION:	SCO UNIX 3.2v4.2
>> IMPACT:	Any user on the system can become root.
>> REPEAT BY:	Logging in. Exploit details are available from any teenage hacker.
>> FIX:		Obtain patch from your vendor.
>
>...so the only serious security loophole we have is, er, login(1) . Hmmm...

It wouldn't be the first OS with a buggy login. Several systems had

myhost login: -froot
#

a while back.  (And equivalent rlogin/telnet holes).

Alan
-- 
  ..-----------,,----------------------------,,----------------------------,,
 // Alan Cox  //  iialan@www.linux.org.uk   //  GW4PTS@GB7SWN.#45.GBR.EU  //
 ``----------'`----------------------------'`----------------------------''

davidsen@tmr.com (bill davidsen) writes:

>This "security by obscurity" policy is a crock; I've been helping keep
>business systems secure for over 25 years, and full disclosure has
>always been best, allowing the system administrators to understand and

Full disclosure by 8lgm once got my machine broken into in the
nighttime hours before I next read c.s.u.. I'd _far_ prefer to have
the opportunity to take some defensive action before every weenie was
given the ability to crack my system.

So you had to take your SCO boxes off the net. Diddums. _I_ had to
call the police!

+-----------------------------------+----------------------------------------+
|                                   | "A man with one watch knows the time;  |
|      zik@zikzak.apana.org.au      |  but a man with two is never sure."    |
+-----------------------------------+----------------------------------------+

Zik Saleeba (zik@zikzak.apana.org.au) wrote:
: davidsen@tmr.com (bill davidsen) writes:

: >This "security by obscurity" policy is a crock; I've been helping keep
: >business systems secure for over 25 years, and full disclosure has
: >always been best, allowing the system administrators to understand and

: Full disclosure by 8lgm once got my machine broken into in the
: nighttime hours before I next read c.s.u.. I'd _far_ prefer to have
: the opportunity to take some defensive action before every weenie was
: given the ability to crack my system.

I don't think that it is unusual for the "weenies" to be cracking your 
system for quite some time before the 8lgm advisory came out.  Simply 
because system administrators hear about a hole for the first time 
through 8lgm doesn't mean that others didn't hear about it earlier.

--

- Paul "Shag" Walmsley <ccshag@everest.cclabs.missouri.edu>
  "The only difference between myself and a madman is that I am not mad."
       - Salvador Dali

Michael P. Deignan (md@pstc3.pstc.brown.edu) wrote:
: In article <8LGM.94Nov28004011@bagpuss.demon.co.uk>,
: 	[8LGM] Security Team <8lgm@bagpuss.demon.co.uk> wrote:

: >PROGRAM:	login(1)
: >VERSION:	SCO UNIX 3.2v4.2
: >IMPACT:	Any user on the system can become root.
: >FIX:		Obtain patch from your vendor.


: Boy, this one was really helpful. Maybe I should just disable the
: "login" command until a patch becomes available, huh?

I'd have to say that this advisory was even more useless than something 
CERT would release. 

Paul 'Shag' Walmsley (ccshag@sgi2.phlab.missouri.edu) wrote:
: Zik Saleeba (zik@zikzak.apana.org.au) wrote:
: : davidsen@tmr.com (bill davidsen) writes:

: : >This "security by obscurity" policy is a crock; I've been helping keep
: : >business systems secure for over 25 years, and full disclosure has
: : >always been best, allowing the system administrators to understand and

: : Full disclosure by 8lgm once got my machine broken into in the
: : nighttime hours before I next read c.s.u.. I'd _far_ prefer to have
: : the opportunity to take some defensive action before every weenie was
: : given the ability to crack my system.

: I don't think that it is unusual for the "weenies" to be cracking your 
: system for quite some time before the 8lgm advisory came out.  Simply 
: because system administrators hear about a hole for the first time 
: through 8lgm doesn't mean that others didn't hear about it earlier.

: --

: - Paul "Shag" Walmsley <ccshag@everest.cclabs.missouri.edu>
:   "The only difference between myself and a madman is that I am not mad."
:        - Salvador Dali

Naah Naah Na Naah Naah,
I know a secret,
I'm not going to tell you.
But you'd better worry.
Naah Naah Na Naah Naah!

This is indeed a crock.  Tell us what to look for or don't say anything!  
Those who crack have the time to figure out what your secret is.  Those 
who admin don't.


-- 
gburnore@garys.arasmith.com
--------------------------------------------------------------------------
                How you look depends on where you go.
--------------------------------------------------------------------------
                                     | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Gary L. Burnore                      | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Director, Programming & Development  | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Myers Information Systems, Inc.      | �۳ 3 4 1 4 2 �ݳ޳ 6 9 0 6 9 ���
                                     |     Official Proof of Purchase
==========================================================================

	Just to be annoyingly anal about this, the 8glm advisory said
that the problem was with "login".  So the smart thing to do is
disable programs and protocols that call login: telnetd, rlogind,
rshd, and if you don't have a secure console, getty or whetever it is
on SCO boxes that manages console terminals.  Your Web, ftp, News, etc
services don't need to be taken offline because of a bug in login.

	That aside, I'm still on the fence about the full disclosure
bit.  Right now I'm in favor of full disclosure, so that the problem
can be fixed as soon as possible.  An example would be the login bug
that cropped up in Linux a few months ago.  Because the linux
community is based on full disclosure, patches were out less than
three hours after the bug was reported.  (Less sloppy patches were out
a day later, after much debate on the "proper" way to fix the
problem.)  

	However, the same bug showed up in AIX, and it was a few days
before patches were available.  In this situation, every AIX machine
that had an rlogin daemon running was vulnerable.

	How about a policy of "three days warning" or something to
that effect.  8glm could send out a message as soon as a security
problem appears, giving recommended actions.  Three days later, when
everyone has had a chance to take those actions if they want, the
nature of the hole is described.  Perhaps several days to a week
afterwards, an exploit program might be released.  The point is that
making the announcement of a security hole in several stages might
solve many of the problems that folks have been pointing out as this
debate has raged on.  I'm sure that someone has suggested this before,
but I thought I'd raise the idea again.


--
Lee Silverman, Brown class of '94, Brown GeoPhysics ScM '95
Email to: Lee_Silverman@brown.edu
Phish-Net Archivist: phish-archives@phish.net
"Nonsense - you only say it's impossible because nobody's ever done it."

In article <3bg70j$78h@zikzak.apana.org.au>,
	Zik Saleeba <zik@zikzak.apana.org.au> wrote:

>Full disclosure by 8lgm once got my machine broken into in the
>nighttime hours before I next read c.s.u.. I'd _far_ prefer to have
>the opportunity to take some defensive action before every weenie was
>given the ability to crack my system.

Okay, this is a legitimate gripe. However, how are you supposed to take
"defensive" action when you don't know the nature of the problem. The
specific message that I criticized was one that said there is a problem
with login. Great, that helps me alot. Maybe I would just disable the
login command until further notice?


>So you had to take your SCO boxes off the net. Diddums. _I_ had to
>call the police!

Part of having our SCO boxes "on the net" is to allow us easy
communication with our counterparts, and share information about
many things -- including potential security problems. Postings such as
the one I criticized offer nothing but wasted bandwidth.

MD
-- 
--   Who needs looks when you have taste?
--  
--   "I'm not a bigot -- I hate everyone."

<snip>

: This is indeed a crock.  Tell us what to look for or don't say anything!  
: Those who crack have the time to figure out what your secret is.  Those 
: who admin don't.

I have to go along with this one.   What has happened is that all would-be
crackers have been informed that there is yet another hole, and they have 
been told where to begin working.   We admins, on the other hand, have been
told there is a hole, where it is, but not what to do.   I for one sure as
hell can't spend a whole lot of time trying to figure this one out.

No matter when disclosure is made, there will be cases where hackers will
find out before all admins have, no matter how it is done.

Better to keep it quiet until full disclosure can be given, and the patch
is ready, tested, and implemented on a number of systems.

In article <3bg70j$78h@zikzak.apana.org.au>,
Zik Saleeba <zik@zikzak.apana.org.au> wrote:
>davidsen@tmr.com (bill davidsen) writes:
>
>>This "security by obscurity" policy is a crock; I've been helping keep
>>business systems secure for over 25 years, and full disclosure has
>>always been best, allowing the system administrators to understand and
>
>Full disclosure by 8lgm once got my machine broken into in the
>nighttime hours before I next read c.s.u.. I'd _far_ prefer to have
>the opportunity to take some defensive action before every weenie was
>given the ability to crack my system.

So maybe it is better to first post the necessary patches, and only make
the exploit script available a day or what later?

And if there isn't a patch available yet just mention that there is a
security problem and that they are waiting for the patch to be released
before the exploit script is made available? oh, right, they did that
already. But I have to agree that the amount of information available
was about zero. Indicating ways to "reasonably" secure the system would've
been nice (if tcp wrappers would help, or if making login non setuid root
would help, as a temporary solution that is).

Also, someone mentioned in this thread that system administrators have to
listen in to all the cracker circles because that is where a lot of
security information is available at an early time. Someone else
mentioned that they wanted to have a life too... something which
crackers obviously don't, given the time needed to actually get at the
info. But I thought that's why I subscribed to 8lgm in the first place?
To act as a substitute for roaming all underground fsp servers and
obscure BBSes for hot info, who happen to change location and number
every week?

I think the 8lgm list can be a bit more informative than it has been
for the recently sent advisories (for example: i really think releaving
the bug in sunos binmail wouldn't harm. Replacements ARE available, just
not from SUN (procmail, mail.local). Oh, do I smell commercialisation here?)

Regards,

-- 
Jan-Pieter Cornet
<cornet@otech.fgg.eur.nl>

mpdillon@halcyon.com (Michael Dillon) writes:
>You have made an eloquent case why sysadmins should monitor
>cracker mailing lists, newsgroups, newsletters, BBSes, etc...


Which is just EASY AS PIE to do.
-- 
Pete Hartman		       Bradley University	pwh@bradley.bradley.edu
                        Hail Eris!  All Hail Discordia!

In article <seagullCzzzL6.FLz@netcom.com>, Seagull <seagull@netcom.com> wrote:
| A little bird told me that bill davidsen (davidsen@tmr.com) wrote:

| > This "security by obscurity" policy is a crock; I've been helping keep
| > business systems secure for over 25 years, and full disclosure has
| > always been best, allowing the system administrators to understand and
| > evaluate the problems for their own machines. This "we won't tell you
| > what the problems is, but there is one, and the vendor will tell you
| > when it's fixed, but you won't be able to test it because the problem is
| > a SECRET only the few are allowed to know" policy translates to the
| > crackers having the info on their mailing lists and BBS's, while
| > legitimate system owners are in the dark.
| 
| This, IMHO, is not.  So your solution is to give every two-bit idiot
| that doesn't have the brains to be a cracker, but enough brains to read
| and be dangerous a sure-fire way of becoming 'root' on your system?  How
| many crackers do you think there are in the world?  How many cracker-
| wannabe's are there?  I'll bet you everything I own that the second group
| is larger than the first.

Right now my entire consulting organization, both locations, if off the
net because we use SCO servers as gateways and have no way to evaluate
the danger. We will probably be back up on another operating system
this weekend. The fact that the novice crackers don't have the
information doesn't bother me, *I* have no idea if this depends on
nothing but access to the login command, or if other holes must be left
open, as well.

There's enough information for the crackers to know where to start,
without me knowing the nature or magnitude of the risk.
|  
| And, not everyone who would be tempted to try this trick to login as 'root'  
| is subscribed to mailing lists and/or BBS's.  There are quite a few 
| people in the world, however, that would be more than happy to try something 
| like this if they were handed the solution on a silver platter, whether 
| or not they have had any incliniations or desires to becoming a cracker 
| in the first place. 

Once the word is out that there is a hole in SCO, the expertise of the
people having the information is not the issue, the risk to the system
is. Unless I can find this info on a cracker BBS somewhere (and I don't
even have a starting place at the moment), our SCO systems are going to
be off the air, or on their own net feed.

No, I don't intend to use a patch (if available) which is labeled "this
fixes a security hole but we won't tell you what it was or how to test
that you have it now and don't have it after this patch is applied."

Does this mean SCO will have to get their system C2 rated all over again?
-- 
Bill Davidsen (davidsen@tmr.com) UNIX Codger
	Will solve problems for money.
Stupidity, like virtue, is its own reward.

In article <3bipc1$2mg@usenety1.news.prodigy.com>,
bill davidsen <davidsen@tmr.com> wrote:
>In article <seagullCzzzL6.FLz@netcom.com>, Seagull <seagull@netcom.com> wrote:
>| A little bird told me that bill davidsen (davidsen@tmr.com) wrote:
>
>| > when it's fixed, but you won't be able to test it because the problem is
>| > a SECRET only the few are allowed to know" policy translates to the
>| > crackers having the info on their mailing lists and BBS's, while
>| > legitimate system owners are in the dark.
>| 
>| This, IMHO, is not.  So your solution is to give every two-bit idiot
>| that doesn't have the brains to be a cracker, but enough brains to read
>| and be dangerous a sure-fire way of becoming 'root' on your system?

As someone else said, better the idiot than one who could exploit this
_without_ the knowledge in the exploitation scripts.

I'd rather have the exploitation scripts; I keep up with the newsgroup
DAILY for this very reason. If we were actually connected to the 'net
instead of just having phone dial-in, I'd read it several times a day.

>
>There's enough information for the crackers to know where to start,
>without me knowing the nature or magnitude of the risk.

Precisely. Any decent hacker wouldn't _need_ the exploitation script,
but merely knolwedge that there _was_ a hole (although granted the script
would make their job easier as well). I on the other hand am stuck here
going "Oh, right, like I could just _guess_ what the hole is, right?  And
like I have time to play with it til I figure out what it is."

>No, I don't intend to use a patch (if available) which is labeled "this
>fixes a security hole but we won't tell you what it was or how to test
>that you have it now and don't have it after this patch is applied."

Oh, and this as well.

I have a problem with just installing a program and taking it on faith, and
not having any clue what it is going to do. This _certainly_ applies to
patches that I don't understand the hole 'tis patching.

I'm still pissed that 8lgm is hamstrung in this way.

I think what we need is some cryptography.  8lgm could encrypt the
exploit script, and then provide the decryption key to verified sysadms.
The issue of how to verify a sysadms is a big one, but this would enable
8lgm to continue to provide the necessary advisories, without giving
the crackers any more advantage than they already have.

One way I can think of to verify these people is to only send the key to
people listed as the technical or administrative point of contact for
a domain, as shown by the WHOIS command.  I know this is not
foolproof, but it's better than what we have right now, which is *NO*
information at all about this bug.

Of course now we have the problem of finding a cryptographic method
which works for both U.S. and foreign sites.  ;-)
-- 
Mark Galbraith                     Voice:  +1 510 449 0606 x6513
Senior Software Engineer/Postmaster        FAX:  +1 510 373 9611
Triad Systems Corporation                  E-mail: mgg@triad.com
Livermore, California                "#include <std/disclaimer>"

Pete Hartman aka pwh@bradley.bradley.edu wrote:
{ mpdillon@halcyon.com (Michael Dillon) writes:
{ >You have made an eloquent case why sysadmins should monitor
{ >cracker mailing lists, newsgroups, newsletters, BBSes, etc...


{ Which is just EASY AS PIE to do.

Which shows just how difficult it is to make a pie.  Let's just all stop 
working and sign up for every BBS and every newsgroup and every mailing 
list and every newsletter. 

Hmm, wait a minute @bradley.bradley.edu?  Oh, no wonder you have so much 
time.  You're in school.
-- 
gburnore@garys.arasmith.com
--------------------------------------------------------------------------
                How you look depends on where you go.
--------------------------------------------------------------------------
                                     | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Gary L. Burnore                      | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Director, Programming & Development  | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Myers Information Systems, Inc.      | �۳ 3 4 1 4 2 �ݳ޳ 6 9 0 6 9 ���
                                     |     Official Proof of Purchase
==========================================================================

In article <LEE.94Nov30001236@netspace.students.brown.edu>,
lee@netspace.students.brown.edu (Lee Silverman) wrote:
> 
> 	Just to be annoyingly anal about this, the 8glm advisory said
> that the problem was with "login".  So the smart thing to do is
> disable programs and protocols that call login: telnetd, rlogind,
> rshd, and if you don't have a secure console, getty or whetever it is
> on SCO boxes that manages console terminals.  Your Web, ftp, News, etc
> services don't need to be taken offline because of a bug in login.

While this may seem perfectly obvious to you and I, not all sysadmins
are intimately familiar with the internals of TCP/IP and inetd.conf.
If your suggestion would indeed have prevented security from being
breached then it should DEFINITELY have been explained in that same
warning about the hole.

> 	That aside, I'm still on the fence about the full disclosure
> bit.  Right now I'm in favor of full disclosure, so that the problem
> can be fixed as soon as possible.  

IMHO, if there is no readily available workaround, then full disclosure
is bad. But there must be plenty of experts available for private
consultation on these matters so that the announcements could be
delayed for a few hours while a workaround is prepared and documented.

---------------------------------------------------------------------
Cool cats, brick bats, bad boys wearin' big hats
Surf's up, my cup, floating, flying, rising up.

Michael Dillon                    mpdillon@halcyon.com
C-4 Powerhouse, RR #2             michael@junction.net
Armstrong, BC   V0E 1B0           Fido: 1:353/350
Canada                             BBS: +1-604-546-2705

seagull@netcom.com (Seagull) writes:
>> This "security by obscurity" policy is a crock; I've been helping keep
>> business systems secure for over 25 years, and full disclosure has
>> always been best, allowing the system administrators to understand and
>> evaluate the problems for their own machines. This "we won't tell you
>> what the problems is, but there is one, and the vendor will tell you
>> when it's fixed, but you won't be able to test it because the problem is
>> a SECRET only the few are allowed to know" policy translates to the
>> crackers having the info on their mailing lists and BBS's, while
>> legitimate system owners are in the dark.

>This, IMHO, is not.  So your solution is to give every two-bit idiot
>that doesn't have the brains to be a cracker, but enough brains to read
>and be dangerous a sure-fire way of becoming 'root' on your system?  How
>many crackers do you think there are in the world?  How many cracker-
>wannabe's are there?  I'll bet you everything I own that the second group
>is larger than the first.

So, seagull, what _you're_ saying is that it's no longer the system
administrator's responsibility to take all appropriate and necessary
measures to stay abreast of current security problems, check to see if
they are subject to them, fix if possible, avoid if not, and know what
sorts of attacks to look for?

Whew...

that was gonna be a _lot_ of work.

Glad it's not my problem, anymore.

Cheers,
-- jra
-- 
Jay R. Ashworth       High Technology Systems Consulting              Ashworth
Designer             Linux: The Choice of a GNU Generation        & Associates
ka1fjx/4         "The difference between theory and practice   +1 813 790 7592
jra@baylink.com   is bigger in practice than in theory" -pds         NIC: jra3

iialan@iifeak.swan.ac.uk (Alan Cox) writes:
>>> FIX:		Obtain patch from your vendor.
>>...so the only serious security loophole we have is, er, login(1) . Hmmm...
>It wouldn't be the first OS with a buggy login. Several systems had

>myhost login: -froot
>#

>a while back.  (And equivalent rlogin/telnet holes).

Including my Linux box, about to go live.  

Proving everyone's point.

Thanks, Alan.

Whom do I shoot?

( and I just figured out why it works.  anyone else? :-)
Cheers,
-- jra
-- 
Jay R. Ashworth       High Technology Systems Consulting              Ashworth
Designer             Linux: The Choice of a GNU Generation        & Associates
ka1fjx/4         "The difference between theory and practice   +1 813 790 7592
jra@baylink.com   is bigger in practice than in theory" -pds         NIC: jra3

Michael Dillon (mpdillon@halcyon.com) wrote:
: You have made an eloquent case why sysadmins should monitor
: cracker mailing lists, newsgroups, newsletters, BBSes, etc...

Personally, I have more than enough to do as a programmer, analyst,
and full-time grad student at UCLA than to have to track yet another
list that addresses secuirty and wade through the low signal to noise
in that list.

I'd have to agree that "security through obscurity" is in fact a
crock, having practised it several times, and having been burned
each time.

-scottm

Gary L. Burnore (gburnore@netcom.com) wrote:
: Paul 'Shag' Walmsley (ccshag@sgi2.phlab.missouri.edu) wrote:

: : I don't think that it is unusual for the "weenies" to be cracking your 
: : system for quite some time before the 8lgm advisory came out.  Simply 
: : because system administrators hear about a hole for the first time 
: : through 8lgm doesn't mean that others didn't hear about it earlier.

: Naah Naah Na Naah Naah,
: I know a secret,
: I'm not going to tell you.
: But you'd better worry.
: Naah Naah Na Naah Naah!

: This is indeed a crock.  Tell us what to look for or don't say anything!  
: Those who crack have the time to figure out what your secret is.  Those 
: who admin don't.

What 'secrets' are you talking about?  I'm merely making a statement of
fact (that should be obvious to anyone who has had a Unix system up on the
'Net for any extended period of time).  We've had several people hack root
on our systems via holes that had no advisories or exploit scripts were
released for. 

Look elsewhere for someone to flame meaninglessly next time.

--

- Paul "Shag" Walmsley <ccshag@everest.cclabs.missouri.edu>
  "The only difference between myself and a madman is that I am not mad."
       - Salvador Dali

In article <8LGM.94Nov28004011@bagpuss.demon.co.uk>, 8lgm@bagpuss.demon.co.uk ([8LGM] Security Team) writes:
> IMPACT:
> 
> 	Any user on the system can become root.
        ^^^^^^^^               ^^^^^^^^^^^^^^^

This means the bug is dangerous.

> 
> REPEAT BY:
> 
> 	Exploit details will not be made available until a patch
> 	is available.

I know that you've been flamed for posting scripts but this information
is useless. Now I know a problem exists. So what? What can I do? Nothing.
Because I don't know where the problem lies. And I cannot fix it as there 
is no patch available (and I don't have any idea when it is going to be).
 

In article <3bg70j$78h@zikzak.apana.org.au> 
zik@zikzak.apana.org.au (Zik Saleeba) writes:
 |
 |Full disclosure by 8lgm once got my machine broken into in the
 |nighttime hours before I next read c.s.u.. I'd _far_ prefer to have
 |the opportunity to take some defensive action before every weenie was
 |given the ability to crack my system.

What about a mailing list where they distribute disclosures encrypted
by PGP (encrypted with the public key of the individual subscribers) ?
A mailing list composed by having your company officials verify who
you are, so not just anybody can join. Also; have people subscribe to
advisories on individual platforms so that you don't have to mail
EVERYTHING to EVERYBODY.

You need to work a bit to hack that and it will take some
CPU time, but it might just be worth it.

Anyway, it's just a suggestion.

-Bjorn
--
106 396 80 35 340 arc 106 396 lineto closepath 106 496 fill
/Times-Roman 43 selectfont 130 385 moveto (borud@pvv.unit.no) show 130
440 10 0 360 arc 1.0 setgray 150 430 fill 142 455 moveto 120 465
lineto stroke showpage %% 1 minute of PostScript...

In article <BORUD.94Dec1133525@istind.dsl.unit.no> borud@dsl.unit.no (Bj�rn Borud) writes:

   What about a mailing list where they distribute disclosures encrypted
   by PGP (encrypted with the public key of the individual subscribers) ?
   A mailing list composed by having your company officials verify who
   you are, so not just anybody can join. Also; have people subscribe to
   advisories on individual platforms so that you don't have to mail
   EVERYTHING to EVERYBODY.

Hmm. I do appreciate that 8lgm has taken the hint and stopped posting
the blatant exploitation scripts. Last time they did that, I called
several commercial providers I know the sys-admins of, cracked root,
and called the sys-admins to explain the urgency of fixing the holes.
They really did invite people to break in immediately, while us
sys-admins have to examine the fixes and preferably do backups before
altering our systems. This was especially bad when they posted over
the weekend, when many sys-admins were home with their families and
many hackers were up late because they couldn't get a date....

However, by posting the holes very publicly, they have encouraged
people to keep up to date and fix the holes *now*, and told *all* of
us about it so we realize it needs to be fixed. While security through
obscurity is bad, so is hackery through obscurity: it's important to
publicize that people know and use these holes. And it beats the hell
out of wading through phrack to find the subtle holes some folks
mention and the fix for your system. 8lgm is being better than CERT in
this sense as well: they publicize dangerous holes that vendors could
otherwise ignore, leaving us dangerously vulnerable.

				Nico Garcia
				raoul@athena.mit.edu

mgg@triada.triad.com (Mark Galbraith) writes:
>I think what we need is some cryptography.  8lgm could encrypt the
>exploit script, and then provide the decryption key to verified sysadms.

And how do you propose they verify them?

And how do you make sure they only give the key to verifiably trusted
people?

I can't see that working.

>One way I can think of to verify these people is to only send the key to
>people listed as the technical or administrative point of contact for
>a domain, as shown by the WHOIS command.  I know this is not
>foolproof, but it's better than what we have right now, which is *NO*
>information at all about this bug.

I suppose that might work.  But still, once the keys are out, people
will start trading them, et voila you have the same situation where
the crackers get the info too.
-- 
Pete Hartman		       Bradley University	pwh@bradley.bradley.edu
 I fear we have not gotten rid of "God" because we still have faith in grammar

gburnore@netcom.com (Gary L. Burnore) writes:
>Pete Hartman aka pwh@bradley.bradley.edu wrote:
>{ mpdillon@halcyon.com (Michael Dillon) writes:
>{ >You have made an eloquent case why sysadmins should monitor
>{ >cracker mailing lists, newsgroups, newsletters, BBSes, etc...
>{ Which is just EASY AS PIE to do.
>Which shows just how difficult it is to make a pie.  Let's just all stop 
>working and sign up for every BBS and every newsgroup and every mailing 
>list and every newsletter. 

Since yet another person missed it, I was being SARCASTIC.

I was pointing out that it is FAR from easy.  Even if you know the
sites/lists/whatever, you generally won't get any info until you've
proven yourself in some manner.  I don't have time to play spy and
infiltrator.




>Hmm, wait a minute @bradley.bradley.edu?  Oh, no wonder you have so much 
>time.  You're in school.

Hey wait!  You're at netcom, you must be a clueless user, right?

Nice assumption.  I work for the university, and have for 6 years.

Next time try to get it right.  There are more people than just students
at Universities last time I checked.
-- 
Pete Hartman		       Bradley University	pwh@bradley.bradley.edu
 I fear we have not gotten rid of "God" because we still have faith in grammar

A little bird told me that Jay Ashworth (jra@zeus.IntNet.net) wrote:
>
> So, seagull, what _you're_ saying is that it's no longer the system
> administrator's responsibility to take all appropriate and necessary
> measures to stay abreast of current security problems, check to see if
> they are subject to them, fix if possible, avoid if not, and know what
> sorts of attacks to look for?

That's funny...I don't remember saying that.  :)

Read my original post again, please.  I agreed that 8lgm's method of
saying "login is broken" and providing no other information is a poor
way of alerting sysadmins.  The person who made this objection had a 
valid point: if you're going to say something is broken, provide some
useful information. I believe he asked some decent questions, like
"Does the user also need to have an acocunt on the system?", and so
on.  This is useful: it provides us with information on which we can 
base our decisions.  If that information then in turn points to a need 
for a full disclosure, then go for it.  But I don't think we should be
blindly handing out exploitation scripts without that intermediate
step.


Cheers,
-+JLS

-- 
                    "The best way out is always through."
                              --Robert Frost

seagull@netcom.com                                     seagull@jg.cso.uiuc.edu

A little bird told me that Pete Hartman (pwh@bradley.bradley.edu) wrote:
> gburnore@netcom.com (Gary L. Burnore) writes:
> >
> >Hmm, wait a minute @bradley.bradley.edu?  Oh, no wonder you have so much 
> >time.  You're in school.
>
> Hey wait!  You're at netcom, you must be a clueless user, right?

[snip]

> Next time try to get it right.  There are more people than just students
> at Universities last time I checked.

And there are more than just clueless users at netcom, too.  (Well,
there used to be, anyway...)


Cheers,
-+JLS

:)   <--- This post is smiley-captioned for the humor-impaired


-- 
                    "The best way out is always through."
                              --Robert Frost

seagull@netcom.com                                     seagull@jg.cso.uiuc.edu

seagull@netcom.com (Seagull) writes:
>And there are more than just clueless users at netcom, too.  (Well,
>there used to be, anyway...)


And therein lies the irony that I was trying to exploit to make
my point.

I know other netcom users who aren't clueless either, but a long
lecture kind of waters down the contrast to someone assuming that
because I post from a .edu site I must be a student.
-- 
Pete Hartman		       Bradley University	pwh@bradley.bradley.edu
 I fear we have not gotten rid of "God" because we still have faith in grammar

A little bird told me that Pete Hartman (pwh@bradley.bradley.edu) wrote:
> seagull@netcom.com (Seagull) writes:
> >And there are more than just clueless users at netcom, too.  (Well,
> >there used to be, anyway...)
>
> And therein lies the irony that I was trying to exploit to make
> my point.

You did make your point.  I was telling a joke here (that's what the
"smiley-caption" was for).  Oh well..so much for my life as a 
comedian...


Cheers,
-+JLS

-- 
                    "The best way out is always through."
                              --Robert Frost

seagull@netcom.com                                     seagull@jg.cso.uiuc.edu

Bjxrn Borud (borud@dsl.unit.no) wrote:
: In article <3bg70j$78h@zikzak.apana.org.au>
: zik@zikzak.apana.org.au (Zik Saleeba) writes:
:  |
:  |Full disclosure by 8lgm once got my machine broken into in the
:  |nighttime hours before I next read c.s.u.. I'd _far_ prefer to have
:  |the opportunity to take some defensive action before every weenie was
:  |given the ability to crack my system.

: What about a mailing list where they distribute disclosures encrypted
: by PGP (encrypted with the public key of the individual subscribers) ?
: A mailing list composed by having your company officials verify who
: you are, so not just anybody can join. Also; have people subscribe to
: advisories on individual platforms so that you don't have to mail
: EVERYTHING to EVERYBODY.

: You need to work a bit to hack that and it will take some
: CPU time, but it might just be worth it.

: Anyway, it's just a suggestion.

Ahh.. makes perfect sense.. and to those of us who are interested for purely
informational purposes only? Hell, I might decide to run SCO at one
point in time.. does it mean because i havent yet shelled out $2000 for
an operating system that you're more privelidged?

Just a rebuttal..

Paul Walmsley aka ccshag@indy56.phlab.missouri.edu wrote:

{ Gary L. Burnore (gburnore@netcom.com) wrote:
{ : Paul 'Shag' Walmsley (ccshag@sgi2.phlab.missouri.edu) wrote:

{ : : I don't think that it is unusual for the "weenies" to be cracking your 
{ : : system for quite some time before the 8lgm advisory came out.  Simply 
{ : : because system administrators hear about a hole for the first time 
{ : : through 8lgm doesn't mean that others didn't hear about it earlier.

{ : Naah Naah Na Naah Naah,
{ : I know a secret,
{ : I'm not going to tell you.
{ : But you'd better worry.
{ : Naah Naah Na Naah Naah!

{ : This is indeed a crock.  Tell us what to look for or don't say anything!  
{ : Those who crack have the time to figure out what your secret is.  Those 
{ : who admin don't.

{ What 'secrets' are you talking about?  I'm merely making a statement of
{ fact (that should be obvious to anyone who has had a Unix system up on the
{ 'Net for any extended period of time).  We've had several people hack root
{ on our systems via holes that had no advisories or exploit scripts were
{ released for. 

The secret is what the hole is. 



{ Look elsewhere for someone to flame meaninglessly next time.

This was  not intended as a flame and it definately was not meaningless.
Think before you accuse next time.


Regards,  gary

{ --

{ - Paul "Shag" Walmsley <ccshag@everest.cclabs.missouri.edu>
{   "The only difference between myself and a madman is that I am not mad."
{        - Salvador Dali
-- 
gburnore@garys.arasmith.com
--------------------------------------------------------------------------
                How you look depends on where you go.
--------------------------------------------------------------------------
                                     | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Gary L. Burnore                      | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Director, Programming & Development  | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Myers Information Systems, Inc.      | �۳ 3 4 1 4 2 �ݳ޳ 6 9 0 6 9 ���
                                     |     Official Proof of Purchase
==========================================================================

Pete Hartman aka pwh@bradley.bradley.edu wrote:
{ gburnore@netcom.com (Gary L. Burnore) writes:
{ >Pete Hartman aka pwh@bradley.bradley.edu wrote:
{ >{ mpdillon@halcyon.com (Michael Dillon) writes:
{ >{ >You have made an eloquent case why sysadmins should monitor
{ >{ >cracker mailing lists, newsgroups, newsletters, BBSes, etc...
{ >{ Which is just EASY AS PIE to do.
{ >Which shows just how difficult it is to make a pie.  Let's just all stop 
{ >working and sign up for every BBS and every newsgroup and every mailing 
{ >list and every newsletter. 

{ Since yet another person missed it, I was being SARCASTIC.
I knew you were, I just wanted to add to the point "we" were making. :)

{ I was pointing out that it is FAR from easy.  Even if you know the
{ sites/lists/whatever, you generally won't get any info until you've
{ proven yourself in some manner.  I don't have time to play spy and
{ infiltrator.

I agree, reading every message is something that I can't do.  


{ >Hmm, wait a minute @bradley.bradley.edu?  Oh, no wonder you have so much 
{ >time.  You're in school.

{ Hey wait!  You're at netcom, you must be a clueless user, right?

{ Nice assumption.  I work for the university, and have for 6 years.

{ Next time try to get it right.  There are more people than just students
{ at Universities last time I checked.
{ -- 
{ Pete Hartman		       Bradley University	pwh@bradley.bradley.edu
{  I fear we have not gotten rid of "God" because we still have faith in grammar
-- 
gburnore@garys.arasmith.com
--------------------------------------------------------------------------
                How you look depends on where you go.
--------------------------------------------------------------------------
                                     | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Gary L. Burnore                      | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Director, Programming & Development  | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Myers Information Systems, Inc.      | �۳ 3 4 1 4 2 �ݳ޳ 6 9 0 6 9 ���
                                     |     Official Proof of Purchase
==========================================================================

Pete Hartman aka pwh@bradley.bradley.edu wrote:
{ seagull@netcom.com (Seagull) writes:
{ >And there are more than just clueless users at netcom, too.  (Well,
{ >there used to be, anyway...)


{ And therein lies the irony that I was trying to exploit to make
{ my point.

{ I know other netcom users who aren't clueless either, but a long
{ lecture kind of waters down the contrast to someone assuming that
{ because I post from a .edu site I must be a student.
{ -- 
{ Pete Hartman		       Bradley University	pwh@bradley.bradley.edu
{  I fear we have not gotten rid of "God" because we still have faith in grammar

Ah, Pete, you missed it.  I never said you were a student! :)

But hey, we're on the same side on this issue so ...

I still think that the advisory should not have been posted at all 
ubnless full disclosure was provided.
-- 
gburnore@garys.arasmith.com
--------------------------------------------------------------------------
                How you look depends on where you go.
--------------------------------------------------------------------------
                                     | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Gary L. Burnore                      | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Director, Programming & Development  | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Myers Information Systems, Inc.      | �۳ 3 4 1 4 2 �ݳ޳ 6 9 0 6 9 ���
                                     |     Official Proof of Purchase
==========================================================================

gburnore@netcom.com (Gary L. Burnore) writes:
>Ah, Pete, you missed it.  I never said you were a student! :)

I guess.

"in school" seems barely distinguishable from "a student" to me though.

>But hey, we're on the same side on this issue so ...

Ok.  Sounds good to me. :-)
-- 
Pete Hartman		       Bradley University	pwh@bradley.bradley.edu
                                You'll have that

Pete Hartman aka pwh@bradley.bradley.edu wrote:
{ "in school" seems barely distinguishable from "a student" to me though.

Yeah, same number of letters...  BTW, has anyone blindly installed the 
SCO patches?  Not that there _are_ patches, is someone going to tell us 
what the hole was?  
-- 
gburnore@garys.arasmith.com
--------------------------------------------------------------------------
                How you look depends on where you go.
--------------------------------------------------------------------------
                                     | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Gary L. Burnore                      | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Director, Programming & Development  | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Myers Information Systems, Inc.      | �۳ 3 4 1 4 2 �ݳ޳ 6 9 0 6 9 ���
                                     |     Official Proof of Purchase
==========================================================================

On Fri, 2 Dec 1994, Gary L. Burnore wrote:

> Pete Hartman aka pwh@bradley.bradley.edu wrote:
> { "in school" seems barely distinguishable from "a student" to me though.
> 
> Yeah, same number of letters...  BTW, has anyone blindly installed the 
> SCO patches?  Not that there _are_ patches, is someone going to tell us 
> what the hole was?  
> -- 

Yes.  Well other than the install script sse002 (login fix) being incorrect.
The fact that one has to be in single user mode in order to install 
the new library (protlib_s) not mentioned in the install form.  Also upon 
installing all of the fixes, and rebooting, once it was at "Type 
Control-D to cont..." it would NOT accept ^D.  It did accept the root 
password but left the stty mode insane, so I stty sane ^M^M^M^M and then 
typed init 2 to get things going.  At this point, things are running; 
stable? Who knows.  


--Dave

-=      David Delgado          =-
-=    System Administrator     =-
-=   Larson Technology, Inc.   =-
-=     davidd@larson.com       =-

In article <MGG.94Nov30141142@triada.triad.com>
           mgg@triada.triad.com "Mark Galbraith" writes:

> I think what we need is some cryptography.  8lgm could encrypt the
> exploit script, and then provide the decryption key to verified sysadms.
> The issue of how to verify a sysadms is a big one,

The issue of what is a sysadm is a bigger one. I connect to the
Internet from my own machine at home. That should make me a sysadm. (I
happen to administer two other machines at work, but that hardly
affects it). If anyone with a PC and a modem is a syadm, the scheme is
worthless: if not, it prevents people with a legitimate need to know
from finding out what problems need to be addressed.

-- 
Charles Bryant (ch@chch.demon.co.uk)

[8LGM] Security Team aka 8lgm@bagpuss.demon.co.uk wrote:
{ This advisory has been sent to:
[SNIP]
{ REPEAT BY:

{ 	Exploit details will not be made available until a patch
{ 	is available.

Ok, so there's a patch available and there's surely been enough time for 
it to be implemented.  So what was this "hole"?

Inquiring admins want to know.
-- 
gburnore@garys.arasmith.com
--------------------------------------------------------------------------
                How you look depends on where you go.
--------------------------------------------------------------------------
                                     | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Gary L. Burnore                      | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Director, Programming & Development  | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Myers Information Systems, Inc.      | �۳ 3 4 1 4 2 �ݳ޳ 6 9 0 6 9 ���
                                     |     Official Proof of Purchase
==========================================================================

In <gburnoreD0EKDn.5Gs@netcom.com>,
Gary L. Burnore (gburnore@netcom.com) wrote:
> Ok, so there's a patch available and there's surely been enough time for 
> it to be implemented.  So what was this "hole"?

See <8LGM.94Dec5015123@bagpuss.demon.co.uk> for instructions on how
to get this information; they've put the exploit scripts on their
fileserver.

The important point for me, and one I really wished they had posted
earlier even if they didn't post the exploit script, was that the
login bug did not allow a user without a valid account to access the
system, it just let an already-logged-in user create files in
directories to which they would not otherwise have access (and, if
they're creative, thereby gain root access).

On the disclosure question, I'm definitely in favor of full
disclosure.  Even before fixes are available, it lets us decide what
the risks to our systems are, and how best to deal with them.  It's
also useful for other purposes; knowing what the SCO holes were, I
made sure that they could not be exploited by a security-related
program I was in the process of writing.  If I hadn't had that
information, it might not have occurred to me to protect against
these attacks.

	-John

--
John Owens        john@micros.com        olorin@access.digex.net
http://access.digex.net/~olorin, or see .plan for PGP public key
------- Technical advisor - Wednesday's Coterie of Thugs -------

John Owens (olorin@access1.digex.net) (<3c5jt7$929@news1.digex.net>) wrote in comp.security.unix:
: In <gburnoreD0EKDn.5Gs@netcom.com>,
: Gary L. Burnore (gburnore@netcom.com) wrote:
: > Ok, so there's a patch available and there's surely been enough time for 
: > it to be implemented.  So what was this "hole"?

: See <8LGM.94Dec5015123@bagpuss.demon.co.uk> for instructions on how
: to get this information; they've put the exploit scripts on their
: fileserver.

: The important point for me, and one I really wished they had posted
: earlier even if they didn't post the exploit script, was that the
: login bug did not allow a user without a valid account to access the
: system, it just let an already-logged-in user create files in
: directories to which they would not otherwise have access (and, if
: they're creative, thereby gain root access).

<snip>
 
    What would be nice would be, instead of a exploit script being posted
initially a - Evaluation and Suggested action - field. Where it evaluates
the risk (such as many known cracks using this hole), and suggests a
solution (chmoding the program, running a wrapper, downing the system,
quick fixes that may detract from the usability of your system, but will
eliminate the risk).