Skip to Content.
Sympa Menu

sm-grimoire - Re: [SM-Grimoire]Security hole + fix for /tmp

sm-grimoire AT lists.ibiblio.org

Subject: Discussion of Spells and Grimoire items

List archive

Chronological Thread  
  • From: Sergey A Lipnevich <sergeyli AT pisem.net>
  • To: eric AT sandall.us
  • Cc: Source Mage - Grimoire <sm-grimoire AT lists.ibiblio.org>
  • Subject: Re: [SM-Grimoire]Security hole + fix for /tmp
  • Date: Mon, 07 Oct 2002 15:09:24 -0400

sorcery creates scripts like /tmp/sorcery-update.sh in there, AFAIR. They'll need to be copied somewhere to be executed, or sourced?

Eric Sandall wrote:

This article brings up a good point when mounting /tmp.
http://online.securityfocus.com/columnists/109

Here's the important part ;) :
"What could I have done to protect my systems? Not wait five weeks to
install security updates, for one thing. For another, as Sandu Mihai
points out on Bugtraq, simply mounting the /tmp directory with noexec and
nosuid will block this worm and a great many other attacks."

Perhaps we should update our /etc/fstab's to do this? And make it so on
the new ISO (when it's out)?

-One of Four
a.k.a. sandalle







Archive powered by MHonArc 2.6.24.

Top of Page