Re: Linux - Poster child for security glitches

From: Fredderic (fredderic@iprimus.com.au)
Date: 11/28/02 

From: "Fredderic" <fredderic@iprimus.com.au>
Date: Fri, 29 Nov 2002 02:42:44 +1000

> Outlook will by default not script controls that have access to the
> filesystem.

"access to the filesystem". Any other triggers for not scripting?

As someone who knew his way around all the common viruses in his youth, I
knew quite well that the old saying "there's more than one way to skin a
cat" is the holy grail of computer viruses. In fact, it's probably the
defining paradigm of the beast.

I refer also to a case of the good old Thunderbyte anti-virus software
(which I used religeously, even after said flaw was found), which had a
trippy means of running executable code in a protected environment to
identify and remove an unknown virus from an infected executable. Worked
like a charm, until someone wrote a virus that could actually infect the
machine through said protected environment. And that was an environment
that was specifically designed do prevent just that.

You allow an untrusted script in a reasonably powerful language anywhere
near an interpreter, and you're asking for trouble. Simple.

Relevant Pages

  • [PATCH] Handle errors in sync_sb_inodes()
    ... time but not reported to the program as shown by the following script ... # We binary search the size of a file in 40M filesystem that can cause ... then expects to find some error code in msync(). ... With this patch, I think it's important to keep the return values of ...
    (Linux-Kernel)
  • [PATCH] fs-writeback: handle errors in sync_sb_inodes()
    ... time but not reported to the program as shown by the following script ... # We binary search the size of a file in 40M filesystem that can cause ... mount fs.40M /mnt -o loop ... a file big enough to provoke a ENOSPC, but small enough to show the ...
    (Linux-Kernel)
  • Re: setuid root
    ... with the priviledge of the root. ... Try checking whether your filesystem, where your script is stored, is ... suid.You can do this by calling mount with the following arguments: ...
    (comp.unix.programmer)
  • Re: System Administration with explanation of the concepts behind (device mapper, e.g.)
    ... The use a script like the following. ... Note that my encrypted filesystem ... The password entry program pinentry-curses should be changed, ... echo "Failed to check filesystem. ...
    (comp.os.linux.setup)
  • Re: Specifying additional mount options
    ... if you create or modify the filesystem correctly via AIX ... being lost on an import/export are incorrectly setting the option. ... A script is not necessary for this..... ... is not really recommended using cio option in /etc/filesystems ...
    (AIX-L)
Loading