Re: rpc.cmsd?
Paul Daw (pauld@pyramid.com)
Mon, 18 Jul 94 21:07:26 PDT
>From bugtraq-owner@fc.net Mon Jul 18 20:42:24 1994
>Received: from goss.pyramid.com
> by sword.eng.pyramid.com (5.61/Pyramid_Internal_Configuration)
> id AA20531; Mon, 18 Jul 94 20:42:24 -0700
>Received: from freeside.fc.net
> by gossip.pyramid.com (5.61/OSx5.1a Pyramid-Internet-Gateway)
> id AA03448; Mon, 18 Jul 94 20:42:23 -0700
>Received: (from majordom@localhost) by freeside.fc.net (8.6.8.1/8.6.6) id PAA02297 for bugtraq-outgoing; Mon, 18 Jul 1994 15:24:28 -0500
>Received: from crimelab.crimelab.com (crimelab.crimelab.COM [198.64.127.1]) by freeside.fc.net (8.6.8.1/8.6.6) with ESMTP id PAA02284 for <bugtraq@fc.net>; Mon, 18 Jul 1994 15:24:08 -0500
>Received: from BGUVM.BGU.AC.IL (vm.bgu.ac.il [132.72.20.2]) by crimelab.crimelab.com (8.6.9/8.6.4) with SMTP id PAA03784 for <bugtraq@crimelab.com>; Mon, 18 Jul 1994 15:19:51 -0500
>Received: from ramon.bgu.ac.il by BGUVM.BGU.AC.IL (IBM VM SMTP V2R2) with TCP;
> Mon, 18 Jul 94 23:21:46 IST
>Received: by ramon.bgu.ac.il (931110.SGI/931108.SGI.ANONFTP)
> for @bguvm.bgu.ac.il:bugtraq@crimelab.com id AA07104; Mon, 18 Jul 94 23:18:41 +0300
>From: jsz@ramon.bgu.ac.il (jsz)
>Message-Id: <9407182018.AA07104@ramon.bgu.ac.il>
>Subject: Re: rpc.cmsd?
>To: rens@imsi.com
>Date: Mon, 18 Jul 94 23:18:41 IDT
>Cc: unkadath!shamus@naucse.cse.nau.edu, bugtraq@crimelab.com
>In-Reply-To: <9407181320.AA02145@lorax.imsi.com>; from "Rens Troost" at Jul 18, 94 9:20 am
>X-Origanization: Ben-Gurion University of the Negev, Beer Sheva, Israel
>X-Mailer: ELM [version 2.3 PL11]
>Sender: bugtraq-owner@crimelab.com
>Precedence: bulk
>
>>
>>
>>
>> >> I've heard there is some method of exploiting rpc.cmsd -- anyone
>> >> have any information on this?
>>
>> jsz> Perhaps
>>
>> What does that mean???
>>
>>
>
>It means that it's quite likely that rpc.cmsd is vulnerable, and there is a
>good chance to locate a security problem in it, which may allow you gain
>access to a system from remote, another root-from-remote, if you want.
>
>
>> Do you work for CERT??
>
>No, did I mail from jsz@cert.org? B-)
>
> ---J
>
>
>
Please don't waste our time with this kind of chatter. Bugtraq is for
full disclosure of security vulnerabilities. This entire exchange has
been pointless, and completely devoid of any useful information.
If anyone knows anything about this, please post it, now that the cat
is outta the bag.
pauld