[12234] in bugtraq
Re: SCO OpenServer 5.0.5 overwrite /etc/shadow
daemon@ATHENA.MIT.EDU (Ralph the Wonder Llama)
Wed Oct 13 20:00:30 1999
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Message-Id: <19991012222713.29679.qmail@ishiboo.com>
Date: Tue, 12 Oct 1999 18:27:13 -0400
Reply-To: sirsyko@ISHIBOO.COM
From: Ralph the Wonder Llama <sirsyko@ISHIBOO.COM>
X-To: belal@SCO.COM
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <199910111437.aa00410@rubidium.pdev.sco.com> from Bela Lubkin at
"Oct 11, 99 02:37:33 pm"
> Brock Tellier wrote:
>
> > Any user may overwrite any file with group auth (i.e. /etc/shadow,
>
> [sad tale which does not require repeating]
>
> Brock, I would like to publically thank you for the auditing you are
> doing. And, I suppose, hang my head in shame at the problems you're
> finding in the process.
>
> You are being heard. Various people and groups at SCO are scrambling to
> fix what's been mentioned. Your discoveries are also prompting various
> proactive security audit efforts. I'm not in a position to make any
> promises about results. I do know that we have good intentions and will
> try to deliver on them as well as we can...
>
> Not an official SCO representative --
beyond the commentary, which should be spared (personally I'd rather see more
meat and less of the idle flaming), I really think it should be pointed out
that the auditing efforts at SCO were not "prompted" because of brocks work.
I know of people who have been at work doing auditing SCO code before the
recent release of SCO advisories. Many (not all) of which were fixed before
these advisories made it to bugtraq. Onfortunately it does take time to notify
the userbase properly, rather than leaving them like sitting ducks after
announcing to the world wehre potential security problems lay.
I'm not trying to downplay brock's efforts (It's great to see a post other
than [Subject: program -flag `perl -e "A"x2000;` has a hole! ]. However, it
is unfair to make it out that SCO could give a rats ass about the security
of its installed userbase.
Adam
