Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

Sun Security Patch Causes Security Hole
ExtremeTech ^ | 12-12-2002 | Brett Glass

Posted on 12/13/2002 2:57:00 AM PST by Yeti

Edited on 04/13/2004 3:04:58 AM PDT by Jim Robinson. [history]

Today, Sun and CERT announced that many of Sun's Cobalt RaQ 4 Linux servers can be completely taken over by a local user or via the Internet. Ironically, the vulnerability is only present if the vendor's optional "Security Hardening Package" is installed. The package is quite popular and is installed on a large percentage of these servers.


(Excerpt) Read more at extremetech.com ...


TOPICS: Business/Economy; Miscellaneous; News/Current Events; Technical; Unclassified
KEYWORDS: hack; linux; microsoft; patch; rmstardotstar; scriptkiddiebait; security; semicolon; sprint; sprintf; sun; sysex; teenhackscript
CGI input validation failure sounds like they forgot to check for semicolons!

In the early days of CGI, email scripts were poular. On UNIX systems, most of them would write the "mail" command to the system, followed by the email address and the body of the message as input by the remote user.

If the user put a semicolon in the email address field, the system would see everything thereafter as a new command.

Since the CGI script exectues with the server daemon's permission, and since the server daemon has root permision, the net effect was to give away root access to the world via the email script.

Could this be a similar flaw?

1 posted on 12/13/2002 2:57:00 AM PST by Yeti
[ Post Reply | Private Reply | View Replies]

To: Sundog; ThinkDifferent; Bush2000; All
What say you, Sun-worshippers and bashers?

No patch for an input validation problem? Is that really all that's going on? Seems like it wouldn't be too hard to release a patch that validates input....

But instead you have to take down your security package...?!?!?!

Does anyone know the real details of the problem?

2 posted on 12/13/2002 3:04:59 AM PST by Yeti
[ Post Reply | Private Reply | To 1 | View Replies]

To: Yeti
Sounds like they hired some former Microsoft employees..
3 posted on 12/13/2002 4:20:10 AM PST by trebb
[ Post Reply | Private Reply | To 2 | View Replies]

To: trebb
Linux systems are virtually crash-proof. And cause so few people run them at home they're not favorite hackers' targets like Microsoft Windows operating systems are.
4 posted on 12/13/2002 4:23:59 AM PST by goldstategop
[ Post Reply | Private Reply | To 3 | View Replies]

To: Yeti
SUN's Solaris is NOT OPEN SOURCE. Its security would improve if it were...
5 posted on 12/13/2002 4:35:45 AM PST by chilepepper
[ Post Reply | Private Reply | To 1 | View Replies]

To: Yeti
Sun/Cobalt provided a fix for this dated Nov 19, 2002 via their FTP site.
http://ftp.cobalt.sun.com/pub/packages/raq4/eng/RaQ4-en-Security-2.0.1-SHP_REM.pkg
6 posted on 12/13/2002 5:29:07 AM PST by unequallawsuntoasavagerace
[ Post Reply | Private Reply | To 2 | View Replies]

To: unequallawsuntoasavagerace
SORRY! - previous post is the date that Sun/Cobalt provides us the PROBLEM.
A solution is still pending.
7 posted on 12/13/2002 5:43:05 AM PST by unequallawsuntoasavagerace
[ Post Reply | Private Reply | To 6 | View Replies]

To: Yeti
Um...couldn't you just shutdown the web administration (I'm assuming this is "linuxconf")?

I mean...there are better ways to admin a server than through a web browser.

8 posted on 12/13/2002 9:55:21 AM PST by B Knotts
[ Post Reply | Private Reply | To 1 | View Replies]

To: B Knotts
These RaQs are pushovers to begin with. They're intended for co-lo sites, so the web interface is really the only way to control them.
9 posted on 12/13/2002 11:16:45 AM PST by TechJunkYard
[ Post Reply | Private Reply | To 8 | View Replies]

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson