Full Disclosure mailing list archives
Re: Database servers on XP and the curious flaw
From: Eliah Kagan <degeneracypressure () gmail com>
Date: Wed, 16 Nov 2005 13:38:21 -0500
David Litchfield wrote:
Hi Eliah,David Litchfield wrote:Hey all, I've just put up a paper on a curious flaw that appears when running aMy intent is not to MS-bash here, but perhaps Microsoft is to blame for not educating people about this issue. (If they had, your paper would be superfluous.)Usually if millions of users are insecure because they don't know something, someone is to blame.To be honest I don't think we're talking millions of people. How many people at home run a fully fledged RDBMS on their XP systems? Very few I'd guess. Besides, Simple File Sharing is documented so MS are educating those willing to seek information. Cheers, David http://www.databasesecurity.com/ http://www.ngssoftware.com/
If I use an insecurely configured database for anything critical, I am insecure. That's everybody at a company that runs such a server and has it configured insecurely, every customer of the company who has personal information stored in the server, etc. I think that amounts to millions. However, it is true that by saying that, I made the problem look more widespread than it actually is, which is bad because it dilutes the power of the term, "millions of users," so that when the next UPnP or DCOM comes around, it will be more difficult to raise awareness about it. For this, I apologize. What I should say is, "usually, if millions of people are at risk of having their information security compromised because a few people don't know something they should, someone is to blame." The fault is certainly distributed, and it's not all on MS's shoulders. Come to think of it, if I (putting myself in the shoes of a clueless network administrator) am running a database server with simple file sharing enabled and not thinking about security, the fault is probably mine. But whoever's fault it is, I hope your paper moves people who don't have their act together, to get it together. -Eliah _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Database servers on XP and the curious flaw David Litchfield (Nov 16)
- Re: Database servers on XP and the curious flaw Eliah Kagan (Nov 16)
- Re: Database servers on XP and the curious flaw David Litchfield (Nov 16)
- Re: Database servers on XP and the curious flaw Eliah Kagan (Nov 16)
- Re: Database servers on XP and the curious flaw Dave King (Nov 16)
- Re: Database servers on XP and the curious flaw James Eaton-Lee (Nov 17)
- Re: Database servers on XP and the curious flaw Dave King (Nov 17)
- Re: Database servers on XP and the curious flaw David Litchfield (Nov 16)
- Re: Database servers on XP and the curious flaw Eliah Kagan (Nov 16)
- Message not available
- Re: Database servers on XP and the curious flaw Eliah Kagan (Nov 16)
- RE: Database servers on XP and the curious flaw James Tucker (Nov 16)
- Re: Database servers on XP and the curious flaw Eliah Kagan (Nov 16)