RE: [cobalt-security] FW: Cobalt RaQ4 Remote root exploit

["Goade, Matthew" <mgoade@xxxxxxxxxxxxxxx>]

I do not know the legal implications of posting a how-to-crack-a-cobalt in a public forum. Sorry!

-----Original Message-----
From: Richard Sidlin [mailto:richard@xxxxxxxxxxx]
Sent: Friday, December 06, 2002 1:00 PM
To: cobalt-security@xxxxxxxxxxxxxxx
Subject: RE: [cobalt-security] FW: Cobalt RaQ4 Remote root exploit


Sorry to be thick but how do you try the exploit please?



Richard Sidlin

> -----Original Message-----
> From: cobalt-security-admin@xxxxxxxxxxxxxxx
> [mailto:cobalt-security-admin@xxxxxxxxxxxxxxx]On Behalf Of Goade,
> Matthew
> Sent: 06 December 2002 18:50
> To: cobalt-security@xxxxxxxxxxxxxxx
> Subject: RE: [cobalt-security] FW: Cobalt RaQ4 Remote root exploit
>
>
> Try the exploit ;-)
> It will tell you if it is or is not vulnerable. Keep in mind it
> will do whatever you tell it to do as root. In other words do not
> test it with rm -rf /home !
>
> -----Original Message-----
> From: Richard Sidlin [mailto:richard@xxxxxxxxxxx]
> Sent: Friday, December 06, 2002 12:11 PM
> To: cobalt-security@xxxxxxxxxxxxxxx
> Subject: RE: [cobalt-security] FW: Cobalt RaQ4 Remote root exploit
>
>
> I'm normally up to date with patches but I don't see anything with SHP
> listed under my installed software. Should I be looking elsewhere?
>
>
>
> Richard Sidlin
>
>
> > -----Original Message-----
> > From: cobalt-security-admin@xxxxxxxxxxxxxxx
> > [mailto:cobalt-security-admin@xxxxxxxxxxxxxxx]On Behalf Of Paul Jacobs
> > Sent: 06 December 2002 17:41
> > To: cobalt-security@xxxxxxxxxxxxxxx
> > Subject: RE: [cobalt-security] FW: Cobalt RaQ4 Remote root exploit
> >
> >
> > At 08:08 AM 12/6/2002, you wrote:
> > >Yes, I get that on a telnet session after every visit to the
> > Admin cosole on
> > >http (web browser)
> >
> > Really, I do not?!
> >
> >
> > >-----Original Message-----
> > >From: cobalt-security-admin@xxxxxxxxxxxxxxx
> > >[mailto:cobalt-security-admin@xxxxxxxxxxxxxxx]On Behalf Of
> Darryl Koster
> > >Sent: Friday, December 06, 2002 9:06 AM
> > >To: cobalt-security@xxxxxxxxxxxxxxx
> > >Subject: RE: [cobalt-security] FW: Cobalt RaQ4 Remote root exploit
> > >
> > >
> > >
> > >
> > >Has anyone else been seeing the following on their telnet sessions
> > >
> > >last login by http
> > >
> > >???
> > >
> > >It started last night when this hack was announced. I did not have that
> > >program installed on my RaQ so when I tried to uninstall it there was a
> > >message basically saying, sorry nothing to uninstall. I have
> > been watching
> > >my logs (all of them) for any sign of weirdness (missing times etc) and
> > >there really is nothing. My shell is basically keeping the history of
> > >everything I am doing etc. So has anyone seen above (http)?
> > >
> > >Darryl Koster
> > >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > >Status Technologies Inc.                   President/Owner
> > >"Let Us Help You Get The Status You Deserve!"
> > >http://www.statustechnologies.com
> > >P: (905) 435-0145  TF (NA) 888-909-9004  F: (905) 435-0873
> > >
> > >
> > >
> > >
> > >-----Original Message-----
> > >From: cobalt-security-admin@xxxxxxxxxxxxxxx
> > >[mailto:cobalt-security-admin@xxxxxxxxxxxxxxx]On Behalf Of Gerald Waugh
> > >Sent: Friday, December 06, 2002 7:26 AM
> > >To: cobalt-security@xxxxxxxxxxxxxxx
> > >Subject: Re: [cobalt-security] FW: Cobalt RaQ4 Remote root exploit
> > >
> > >
> > >On Thu, 5 Dec 2002, njd 76 wrote:
> > >
> > > > i was scared you would say that... jeez...
> > > >
> > > > Well i have a RAQ4 with the SHP installed, since Sun isnt
> > going to answer
> > > > me... anyone else want to tell me what to do. I am scared to use the
> > > > uninstall because some are saying it takes out the imap update.
> > > >
> > > > Any suggestions on what people like me should do?
> > > >
> > >
> > >apply the SHP_REM patch
> > >Which removes it...
> > >
> > >Gerald
> > >--
> > >http://frontstreetnetworks.com | http://raqware.com
> > >Front Street Networks LLC  | Phone: +1 203-785-0699
> > >229 Front Street, Ste. C, New Haven, CT. 06513-3203
> > >
> > >_______________________________________________
> > >cobalt-security mailing list
> > >cobalt-security@xxxxxxxxxxxxxxx
> > >http://list.cobalt.com/mailman/listinfo/cobalt-security
> > >
> > >
> > >_______________________________________________
> > >cobalt-security mailing list
> > >cobalt-security@xxxxxxxxxxxxxxx
> > >http://list.cobalt.com/mailman/listinfo/cobalt-security
> > >
> > >
> > >
> > >_______________________________________________
> > >cobalt-security mailing list
> > >cobalt-security@xxxxxxxxxxxxxxx
> > >http://list.cobalt.com/mailman/listinfo/cobalt-security
> >
> > _______________________________________________
> > cobalt-security mailing list
> > cobalt-security@xxxxxxxxxxxxxxx
> > http://list.cobalt.com/mailman/listinfo/cobalt-security
> >
> > ----------------------------------------------------------
> > This message has been checked for all known viruses by the
> > Help Internet Virus Scanning Service 01707 897111
> >
> >
>
>
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security
>
> ----------------------------------------------------------
> This message has been checked for all known viruses by the
> Help Internet Virus Scanning Service 01707 897111
>
>


_______________________________________________
cobalt-security mailing list
cobalt-security@xxxxxxxxxxxxxxx
http://list.cobalt.com/mailman/listinfo/cobalt-security