Re: Internet Worm
James Seng (jseng@darwin.technet.sg)
Sat, 15 Oct 1994 13:29:15 +0800 (SST)
On Fri, 14 Oct 1994, Norwell Louis Awson wrote:
> Everyone seems to say "the bugs the worm exploited haven't been fixed yet".
The hole in which the worm exploited is fixed but it has spawn off lots
of other idea for cracking.
> Sendmail debug hole fixed.. use Sendmail 8.6.9
Yes..it is fixed. But then remember the smail bug recently in how it
handles ~/.forward file? Most of the idea of exploited the ~/.forward is
indirectly coming from old sendmail bug.
> Vax finger stack overflow fixed.. no fingerd presently uses
> gets()
Fingerd dont use gets(). but gets still exists in many system. Many
programmers still used it in their application despite the warning.
> Trusted hosts and 'r' commands Not fixed. Users will always be
> the hole in your system. Get rid
> of any 'r' commands if this REALLY
> bugs you.
Getting rid for r(sh/login/cp...) application maybe pain in the neck.
Enabled it may create backdoor for cracker.
Anyway, what i did on my system is put a .rhosts file in every user
directory. chmod 000 .rhosts and chown root .rhosts. Not all user needs
.rhosts file. Those who wants to use them email me and i will chown back
to them. (any problem with that? :-)
James Seng Ching Hong ~{W/Uq:j~}
Technet Student Consultant, Technet Unit
Internet: jseng@solomon.technet.sg