Re: Trusted Unices Aren't?

[steve.gailey () db com]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> It seems that nearly nobody noticed that one of latest
vendor-initiated
> bulletin for CERT (mscreen) listed SCO CMW+,
a-claimed-to-be-close-to-B2
> upgrade for SCO Unix, in the list of vulnerable systems. Said to be
> possible root compromise.
>
> How can this happen? How can "a serial multiscreen utility", a
program
> that should have nothing like root privileges on an MLS system, be
> vulnerable _that way_?

Of course if you set CMW+ up correctly then getting root is
meaningless.

Stephen Gailey
Metronome Solutions Ltd
Steve.Gailey () metrosol co uk
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.5.3i for non-commercial use <http://www.pgpi.com>

iQA/AwUBNirz2hVK+Dgi6DDqEQKY/wCfRhybgIFpI98Hq9mEWNzrb6qW7gIAn1mN
WahkejDG4HdhYSvwK++zzlgc
=A8xT
-----END PGP SIGNATURE-----