Baslinux mailing list

[sindi keesan <keesan AT sdf.lonestar.org>]

From a helpful TAG (The Answer Gang) member:

Open ports are not the only security problem. You already got many hints
from the TAG subscribers. Security is not a state that is either
switched on or off by configuration. It is a process and considering the
code people usually run on workstations (graphically or not) it is next
to impossible to predict what code will do in all possible
circumstances.

> http://bcheck.scanit.be found 0 vulnerabilities in Opera 8.52. [...]

If you try http://www.securityfocus.com/vulnerabilities instead and
enter "Opera Software" and then "Opera Web Browser" in the search form
you get a long list of (known) bugs along with their security
implications and possible fixes or upgrades. A Google search for '"opera
8.52" security bugs' has http://security.nnov.ru/soft/8550.html as first
search result. This page says:

"Integer overflow on long stylsheet sttribute. Can potentially be
used for hidden malware installation."

A lot of online scanners are woefully incomplete and only check for the
top 10 (100 or 1000) bugs and a good part of them is designed to work
with MS Windows clients. These scanners are only a part of a security
strategy and their output should be treated as such.

> Another list member pointed out that startx allows only local access to
> the X server so is also not vulnerable.

Some GNU/Linux distributions (such as Debian) also deactivate X's port
6000 by default. Of course this doesn't protect you against running an X
session with lots of software (which is not designed to run as root)
with root privileges.

Apologies for repeating things others have said in this thread. The part
about online scanners and Opera 8.52 made a little noise on my email
radar. :)

Best wishes,
Ren?.


-------------------
Apparently it IS a good idea to run opera only as user.  I will try to 
check out lynx and links as well.  su user lynx.  And fix permissions to 
run ssh as user.

Should I worry about running anything offline as root?

Sindi