Re: Bug#77257: FWD: Joe's Own Editor File Link Vulnerability

2000-11-19 Thread Joey Hess
Alexander Viro wrote: > a) take a look at /etc/init.d/bootmisc.sh. Around "Cleaning: /tmp", that is. So you're editing a file in /tmp and you're worried about the DEADJOE file lying around after a reboot? What about the file itself? > b) several editing sessions in parallel. Well yeah, the file

Re: task-unstable-security-updates?

2000-11-19 Thread Daniel Jacobowitz
On Sun, Nov 19, 2000 at 12:55:00PM -0700, Mike Fisk wrote: > There doesn't seem to be an automatic way to get all of the unstable > packages necessary to address reported security problems. You either > have to watch the security mailing lists and upgrade individual packages > yourself or do a fu

Re: Bug#77257: FWD: Joe's Own Editor File Link Vulnerability

2000-11-19 Thread Alexander Viro
On Sun, 19 Nov 2000, Joey Hess wrote: > Herbert Xu wrote: > > On Sat, Nov 18, 2000 at 11:26:13AM -0500, Jacob Kuntz wrote: > > > > > > what's wrong with the current practice of putting deadjoe in the current > > > directory? > > > > cwd == /tmp > > Belive it or not, it is actually possible to

Re: Bug#77257: FWD: Joe's Own Editor File Link Vulnerability

2000-11-19 Thread Alexander Viro
On Sun, 19 Nov 2000, Joey Hess wrote: > Alexander Viro wrote: > > a) take a look at /etc/init.d/bootmisc.sh. Around "Cleaning: /tmp", that is. > > So you're editing a file in /tmp and you're worried about the DEADJOE > file lying around after a reboot? What about the file itself? cd /tmp joe

Re: Bug#77257: FWD: Joe's Own Editor File Link Vulnerability

2000-11-19 Thread Joey Hess
Herbert Xu wrote: > On Sat, Nov 18, 2000 at 11:26:13AM -0500, Jacob Kuntz wrote: > > > > what's wrong with the current practice of putting deadjoe in the current > > directory? > > cwd == /tmp Belive it or not, it is actually possible to write files to /tmp securely. It's pretty silly to contemp

Re: Bug#77257: FWD: Joe's Own Editor File Link Vulnerability

2000-11-19 Thread Joey Hess
Alexander Viro wrote: > a) take a look at /etc/init.d/bootmisc.sh. Around "Cleaning: /tmp", that is. So you're editing a file in /tmp and you're worried about the DEADJOE file lying around after a reboot? What about the file itself? > b) several editing sessions in parallel. Well yeah, the file

Re: task-unstable-security-updates?

2000-11-19 Thread Daniel Jacobowitz
On Sun, Nov 19, 2000 at 12:55:00PM -0700, Mike Fisk wrote: > There doesn't seem to be an automatic way to get all of the unstable > packages necessary to address reported security problems. You either > have to watch the security mailing lists and upgrade individual packages > yourself or do a f

Re: Bug#77257: FWD: Joe's Own Editor File Link Vulnerability

2000-11-19 Thread Alexander Viro
On Sun, 19 Nov 2000, Joey Hess wrote: > Herbert Xu wrote: > > On Sat, Nov 18, 2000 at 11:26:13AM -0500, Jacob Kuntz wrote: > > > > > > what's wrong with the current practice of putting deadjoe in the current > > > directory? > > > > cwd == /tmp > > Belive it or not, it is actually possible t

Re: Bug#77257: FWD: Joe's Own Editor File Link Vulnerability

2000-11-19 Thread Joey Hess
Herbert Xu wrote: > On Sat, Nov 18, 2000 at 11:26:13AM -0500, Jacob Kuntz wrote: > > > > what's wrong with the current practice of putting deadjoe in the current > > directory? > > cwd == /tmp Belive it or not, it is actually possible to write files to /tmp securely. It's pretty silly to contem

task-unstable-security-updates?

2000-11-19 Thread Mike Fisk
There doesn't seem to be an automatic way to get all of the unstable packages necessary to address reported security problems. You either have to watch the security mailing lists and upgrade individual packages yourself or do a full dist-upgrade every so often. As often as packages get updated i

Re: /dev/fb* permissions, local DoS

2000-11-19 Thread Michael Schmitz
> the reason i ask is there is a pretty nasty security problem with > this, try the following: > > cat /dev/urandom > /dev/fb0 > > on my system i get a instant kernel panic (2.2.17 from ftp.kernel.org). Should not happen - can you post a panic message? Michael

task-unstable-security-updates?

2000-11-19 Thread Mike Fisk
There doesn't seem to be an automatic way to get all of the unstable packages necessary to address reported security problems. You either have to watch the security mailing lists and upgrade individual packages yourself or do a full dist-upgrade every so often. As often as packages get updated

Re: /dev/fb* permissions, local DoS

2000-11-19 Thread Samu
On Sun, Nov 19, 2000 at 06:04:01AM -0900, Ethan Benson wrote: > > does anyone know why debian has /dev/fb* with 622 permissions? > > the reason i ask is there is a pretty nasty security problem with > this, try the following: > > cat /dev/urandom > /dev/fb0 > > on my system i get a instant ker

Re: /dev/fb* permissions, local DoS

2000-11-19 Thread Michael Schmitz
> the reason i ask is there is a pretty nasty security problem with > this, try the following: > > cat /dev/urandom > /dev/fb0 > > on my system i get a instant kernel panic (2.2.17 from ftp.kernel.org). Should not happen - can you post a panic message? Michael -- To UNSUBSCRIBE, e

Re: /dev/fb* permissions, local DoS

2000-11-19 Thread hpknight
This doesn't appear to affect systems running the 2.4.0test series kernels. I'm running 2.4.0-test10 and all it did was fill my screen with random colors .. I could just ctrl-c it and clear the screen. Doesn't seem like there is anything broken by doing chmod 600 /dev/fb*, but all I'm running is

Re: /dev/fb* permissions, local DoS

2000-11-19 Thread Samu
On Sun, Nov 19, 2000 at 06:04:01AM -0900, Ethan Benson wrote: > > does anyone know why debian has /dev/fb* with 622 permissions? > > the reason i ask is there is a pretty nasty security problem with > this, try the following: > > cat /dev/urandom > /dev/fb0 > > on my system i get a instant ke

/dev/fb* permissions, local DoS

2000-11-19 Thread Ethan Benson
does anyone know why debian has /dev/fb* with 622 permissions? the reason i ask is there is a pretty nasty security problem with this, try the following: cat /dev/urandom > /dev/fb0 on my system i get a instant kernel panic (2.2.17 from ftp.kernel.org). since the framebuffer devices are world

Re: /dev/fb* permissions, local DoS

2000-11-19 Thread hpknight
This doesn't appear to affect systems running the 2.4.0test series kernels. I'm running 2.4.0-test10 and all it did was fill my screen with random colors .. I could just ctrl-c it and clear the screen. Doesn't seem like there is anything broken by doing chmod 600 /dev/fb*, but all I'm running is

/dev/fb* permissions, local DoS

2000-11-19 Thread Ethan Benson
does anyone know why debian has /dev/fb* with 622 permissions? the reason i ask is there is a pretty nasty security problem with this, try the following: cat /dev/urandom > /dev/fb0 on my system i get a instant kernel panic (2.2.17 from ftp.kernel.org). since the framebuffer devices are world

Re: restricted bash (rbash)

2000-11-19 Thread Georg Bauer
Hi! In article <[EMAIL PROTECTED]>, Nick Clifford <[EMAIL PROTECTED]> wrote: >Personally, a chroot jail is the only thing I trust when I need to setup >an isolated or restricted environment. Its difficult to break out of a >chroot jail even when you are root, but it can be done. So ensure they >

Re: restricted bash (rbash)

2000-11-19 Thread Georg Bauer
Hi! In article <[EMAIL PROTECTED]>, Nick Clifford <[EMAIL PROTECTED]> wrote: >Personally, a chroot jail is the only thing I trust when I need to setup >an isolated or restricted environment. Its difficult to break out of a >chroot jail even when you are root, but it can be done. So ensure they