🚀 go-pugleaf

cirby@news.gate.net (Chad Irby) wrote:
>Joe Sloan (jjs@dostoevsky.ucr.edu) wrote:
>: Nevin ":-]" Liber <nevin@CS.Arizona.EDU> wrote:

>: >Yea, and the Internet Worm never happened, too. :-(

>: If memory serves me correctly, unix hackers had a handle on the problem
>: within hours of it's outbreak, that being possible because of the open

if source for finger wasn't available to anyone, there would be nothing to
know. Also Internet Worm hapenned because regular u*ix doesn't have a powerful
enough security system. If finger wasn't running as root, worm wouldn't have
been possible.

>You might also remember that the Worm took advantage of a *known* bug in 
>sendmail, 

it was finger not sendmail.

the problem was that finger had a stack based array to accept the command from
the caller. Of course the size of the array was fixed "who would call finger
with more than  X characters?". What Morris did was to compile a piece of code
and send this code as text to a finger daemon. When fingerd read the command,
it overran the stack and Morris was able to take control of the fingerd when
that function tried to return. Voila you have a process running as root on
another system. Or something like this. Pretty cute hack if you ask me. But of
course if the moronic u*ix function which gets a string had an option to limit
the size of the buffer, maybe the programmer would have passed the size of the
array. I am not sure whether there was an alternative function doing the right
thing and whether it was the idiocy of the grad student who wrote fingerd
initially. 

Of course the response to Internet Worm was to not run fingerd instead of
fixing the bug.

Can you believe that the same type of bug has been found in more recent u*ix
daemons (one http server I believe). Just this shows how undisciplined the u*ix
crowd is. 

muzo

standard disclaimer