lkml.org 
[lkml]   [1998]   [Aug]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds


    On Tue, 4 Aug 1998, Brandon S. Allbery KF8NH wrote:

    > Because it's a deliberate tradeoff: it allows you to provide limited
    > Internet access from inside the firewall without opening everything up ---
    > important when "everything" includes commercial database servers of unknown
    > security [...]

    Explain to me how a firewall is protecting your database, to which you
    have no source, from buffer overflow attacks. I missed that part.

    Oh wait, you've got all your CGIs/whatever-your-fav-dyn-content-is
    magically tweaked to never send the "wrong" strings to the db server,
    right?

    Oh! Oh! I know! You're running the db on solaris with stack exec turned
    off!

    :)

    > You're accepting a security risk (while trying to minimize it) in return for
    > increased functionality. The no-stack-exec patch doesn't do this.

    How is the firewall increasing your functionality? As far as I can see it
    restricts your functionality. So does no-stack-exec. So do passwords.
    So does using a bounds checking language. So does taintperl. They all
    solve specific problems, no single one of them is a complete security
    solution.

    Ok I'm getting tired of arguing, could someone invoke the nazi rule?

    Dean



    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

    \
     
     \ /
      Last update: 2005-03-22 13:43    [W:0.020 / U:0.100 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site