[Prev][Next][Index][Thread]

# Re: Fun with FUP and root.

- Date: Wed, 26 Feb 1997 06:56:55 PST
- From:
- Cc: moo-cows@parc.xerox.com
- In-Reply-To: Your message of "Tue, 25 Feb 1997 19:08:55 PST." <Pine.SOL.3.91.970225215255.749A-100000@schoolnet2>

    In message <Pine.SOL.3.91.970225215255.749A-100000@schoolnet2>, Neil Fraser wri
    tes:
    >
    > It doesn't take a rocket scientist to figure out that MOOs with FUP and
    > root perms are a dangerous mix, but not every root knows just how
    > flexible a MOO can be (it isn't just a Dungeon game for the kiddies).
    > Fortunately only wizards who  have UNIX accounts can take advanage of
    > this situation when it arises.
    >
    Warning : I have never looked at MOO server source, so part or all of
    what I'm about to say may make little sense. I'll be pleased to learn
    that my fears are unfounded, but please, no flames.

    I would tend to disagree with what you say. Experience with large programs
    (> 10-20 K source lines) has made painfully obvious that having an account
    on a machine is *not* needed to get a root shell. Just for the fun of it,
    have a look at bugtraq archives or CERT advisories, or do a Web search for
    "buffer overflow". At the moment, MOO has yet to become the security joke
    that, say, sendmail is, but I wouldn't bet on it being hole-free, and lack
    of public knowledge of the holes is no guarantee of security.

    Just my $.02

    Michel Lavondes (lavondes@tidtest.total.fr), speaking only for himself

    "Yea, the heavens shall open and the NP-complete solution be given forth.
    ATT executives shall give birth to two-headed operating systems, and
    copyrights shall be expunged. The voice of the GNU shall be heard, but
    the faithless will be without transceivers." -- Steve Simmons

References:

- Fun with FUP and root.

- From: Neil Fraser <nfraser@schoolnet2.schoolnet.ca>

- Prev: Re: Fun with FUP and root.
- Next: Re: Fun with FUP and root.
- Index: MOO-cows
- Thread: MOO-cows

Home | Subject Index | Thread Index