Re: Sorry!! (was: Re: [cobalt-security] Is this a known bug?)

[Gossi The Dog <gossi@xxxxxxxxxxxxxx>]

Except, you might have something like PHP3/4 installed, which gives users
access to 'system()'.  Hax0r uploads script mentioned on bugtraq, modifies
it SLIGHTLY to make it perform a command rather than dropping to a
rootshell, uploads bash script, makes exploit.php which calls the script.

Kiddies work, and perfectly possible.

Oh, and then theres the old one of Cobalt allowing users to execute
programs in SSI by default...  (see texts available online about using SSI
to compile bindshell.c on the system and executing it).

Regards.

On Mon, 24 Jul 2000, Jeff Lasman wrote:

> Florian Effenberger wrote:
> 
> > > The best way to solve this one is not to allow local users.
> > Sorry, but what do you mean with that?
> 
> This exploit can only be done by someone logged into your server through
> telnet/ssh.
> 
> We just don't give our users that privilege.
> 
> Jeff
> 

-- 
gossi@xxxxxxxxxxxxxxx