Bugtraq mailing list archives
Re: SCO OpenServer 5.0.5 overwrite /etc/shadow
From: sirsyko () ISHIBOO COM (Ralph the Wonder Llama)
Date: Tue, 12 Oct 1999 18:27:13 -0400
Brock Tellier wrote:Any user may overwrite any file with group auth (i.e. /etc/shadow,[sad tale which does not require repeating] Brock, I would like to publically thank you for the auditing you are doing. And, I suppose, hang my head in shame at the problems you're finding in the process. You are being heard. Various people and groups at SCO are scrambling to fix what's been mentioned. Your discoveries are also prompting various proactive security audit efforts. I'm not in a position to make any promises about results. I do know that we have good intentions and will try to deliver on them as well as we can... Not an official SCO representative --
beyond the commentary, which should be spared (personally I'd rather see more meat and less of the idle flaming), I really think it should be pointed out that the auditing efforts at SCO were not "prompted" because of brocks work. I know of people who have been at work doing auditing SCO code before the recent release of SCO advisories. Many (not all) of which were fixed before these advisories made it to bugtraq. Onfortunately it does take time to notify the userbase properly, rather than leaving them like sitting ducks after announcing to the world wehre potential security problems lay. I'm not trying to downplay brock's efforts (It's great to see a post other than [Subject: program -flag `perl -e "A"x2000;` has a hole! ]. However, it is unfair to make it out that SCO could give a rats ass about the security of its installed userbase. Adam
Current thread:
- BUG: Win NT TCP/IP Security filters does not get enforced Stefan Norberg (Oct 08)
- Re: BUG: Win NT TCP/IP Security filters does not get enforced Stefan Norberg (Oct 10)
- Re: BUG: Win NT TCP/IP Security filters does not get enforced David LeBlanc (Oct 12)
- SCO OpenServer 5.0.5 overwrite /etc/shadow Brock Tellier (Oct 11)
- IE 5.0 security vulnerability - reading local (and from any domain, probably window spoofing is possible) files using IFRAME and document.execCommand Georgi Guninski (Oct 11)
- Re: SCO OpenServer 5.0.5 overwrite /etc/shadow Bela Lubkin (Oct 11)
- Re: SCO OpenServer 5.0.5 overwrite /etc/shadow Ralph the Wonder Llama (Oct 12)
- Re: SCO OpenServer 5.0.5 overwrite /etc/shadow Bela Lubkin (Oct 12)
- Xerox DocuColor 4 LP D.O.S Jason Lutz (Oct 13)
- Security of "Virtual Network Computer" Mikael Olsson (Oct 12)
- Re: Security of "Virtual Network Computer" Cameron Simpson (Oct 12)
- Re: Security of "Virtual Network Computer" Dan Foster (Oct 12)
- Re: Security of "Virtual Network Computer" Luca Berra (Oct 13)
- Finjan Alert: WinNT.Infis Trojan by way of Tim Wieneke (Oct 13)
- The old "." problem nblasgen () NICK REFRACT COM (Oct 13)
- Re: The old "." problem David Zverina (Oct 14)
- Re: The old "." problem S.Faust (Oct 16)
- Re: BUG: Win NT TCP/IP Security filters does not get enforced Stefan Norberg (Oct 10)