Skip to Content.
Sympa Menu

sm-grimoire - Re: [SM-Grimoire]Security hole + fix for /tmp

sm-grimoire AT lists.ibiblio.org

Subject: Discussion of Spells and Grimoire items

List archive

Chronological Thread  
  • From: Dufflebunk <dufflebunk AT dufflebunk.homeip.net>
  • To: Sergey A Lipnevich <sergeyli AT pisem.net>
  • Cc: eric AT sandall.us, Source Mage - Grimoire <sm-grimoire AT lists.ibiblio.org>
  • Subject: Re: [SM-Grimoire]Security hole + fix for /tmp
  • Date: 07 Oct 2002 16:36:40 -0400

Cast as well creates "safe-cast" scripts there and execs them.

On Mon, 2002-10-07 at 15:09, Sergey A Lipnevich wrote:
> sorcery creates scripts like /tmp/sorcery-update.sh in there, AFAIR.
> They'll need to be copied somewhere to be executed, or sourced?
>
> Eric Sandall wrote:
>
> >This article brings up a good point when mounting /tmp.
> >http://online.securityfocus.com/columnists/109
> >
> >Here's the important part ;) :
> >"What could I have done to protect my systems? Not wait five weeks to
> >install security updates, for one thing. For another, as Sandu Mihai
> >points out on Bugtraq, simply mounting the /tmp directory with noexec and
> >nosuid will block this worm and a great many other attacks."
> >
> >Perhaps we should update our /etc/fstab's to do this? And make it so on
> >the new ISO (when it's out)?
> >
> >-One of Four
> >a.k.a. sandalle
> >
> >
> >
>
> _______________________________________________
> SM-Grimoire mailing list
> SM-Grimoire AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-grimoire
--


Quidquid latine dictum sit, altum sonatur.
-----------------
PGP public key at
http://wwwkeys.pgp.net:11371/pks/lookup?op=get&search=0x3327A9A5
F1

Attachment: signature.asc
Description: This is a digitally signed message part




Archive powered by MHonArc 2.6.24.

Top of Page