Moderatrs: Please mod the parent of this back down. The security hole was fixed three days ago. Look at the ChangeLog.txt.
Wed Jan 10 12:46:50 PST 2001
(* security fix *)
glibc-2.2 contains a local vulnerability that affects all setuid root
binaries. Any user on affected systems will be able to read any file on
the system through a simple process: The user sets the RESOLV_HOST_CONF
environment variable to the name of the file that they wish to read, then
runs any setuid root program that makes use of that variable. The file is
then written to stderr.
a1/glibcso.tgz: Patched sysdeps/generic/unsecvars.h to fix the problem
with RESOLV_HOST_CONF, and also to add HOSTALIASES to the list. (this
change is noted in glibc-CVS)br>
d1/glibc.tgz: Patched sysdeps/generic/unsecvars.h as above.
The first major release for 2000, Slackware Linux 7.1 builds...
Until that file announces Slackware 7.2, it has NOT been released. It hasn't even been released as beta yet!! Do you think any major distro would release something without releasing a beta beforehand?
What it looks like is happening is Patrick and the rest of the Slackware developers are preparing slackware-current, Slackware's developers release, to be released as a beta. This story on USENET, ummm I mean/., is a little premature.
Of course, Linus has promised a shortening release cycle, so bet accordingly.
Oh really? Is this like the time he said that in 1999 about 2.4? Not bashing or anything, I think Linus should release when he thinks it's ready, I'm just saying that you might want to bet on it (ha ha).
It just means you should add a year to whatever you bet is. (Or to whatever Linus announces as the expected release date)
I'm glad I'm in the military. About the worst thing they can do to me is tell me I'm going to Kosovo for six months, and that I'm leaving in two hours.
At least I know I'm still going to get a pay check...
She goes to get an editor and promptly is greeted with a dozen!! Wonderful that she has all those choices, but sheesh, do we really need a dozen listed? And on top of that, that didn't include a number of smaller ones that I know were installed (such as vi).
Spotting a Honeypot is fairly easy. The first thing you do when you gain access to a computer is ask yourself one simple question,
What is this computer used for?
Then try to answer that question. People don't attach computers to the internet for no reason. What services is it running? If it's an ftp server, what files are available? Is it a webserver? Look at the webpage. If ftp services are being provided but the ftp directory is empty or the webpage has is the default one install with the OS, then something is up.
Check for user activity. Are there any users? Goto ~/.netscape (if the machine is unix). What are the timestamps on the files. Does the user have any email. By looking at the appropriate files (depending on OS) you can tell when it was installed. Has anything changed since then? Do a find on files changed over the last seven days. If there is no user activity, something is definitly wrong!!
Check for changes made to configuration files. Check the files that a sysadmin would most likely change. If you can't find any changes (other than LOTS of logging - another Red Flag!), check to see if the system looks like a default install (if you are into this, you should know what default installs look like/the common security holes the vendor leaves open/etc.). If it is a default install and the install is older than a week, congratulations, you've found a Honey Pot.
One last check before getting the hell out of dodge, sniff the network. Who else is one it? Honey Pots tend to be isolated. If the only activity you see is yourself (unless you are connected at midnight, but then you deserve to get caught) or the only other traffic is logging activity (from the one you are on to somewhere else), You've been had!! Just for shits and grins, ping the subnet you are on. People and companies don't waste network equipment as it is fairly expensive. If the machine you are on is the only one on that subnet....
David, Chris, and Logan are three of the friendliest and most helpfull developers I've ever met. They regularly answer questions and post information on the web forums on www.slackware.com. They can also be found at #slackware on irc.openprojects.net. I've seen them help more people on irc then I can count, from newbies to gurus alike.
All three need to be recognized and applauded for their efforts and commitment to the community.
How did this get modded up? While the original posters "logic" leaves something to be desired, your reasoning has fallen into a logical fallacy itself.
Post hoc ergo propter hoc - "after this, therefore because of this"
You are assuming cause-and-effect relationships were there are none. You are assuming one event presedes the other, the first being the cause of the second. i.e. - you are making shit up that has no possible way of being related to one another or being true.
"Assumption is the mother of all fuckups." - quote from some movie.
When people start using "logic" as an argument, they usually have no idea what logic is themselves.
Hemos seems to have a problem with reading comprehension. He gets todays Short Bus Award.
For those interested in what's the ruling means, CNN has a better explanation.
Several of my friends have written slashdot off as a waste of time. I'm starting to agree with them.
Surely every state should have the same design for ballot sheets, and they should be boring and completely free from any attempts at design.
But that is UnAmerican. You would be depriving somebody of their God-given right to contract out the making of ballots for [insert state] to their brother... err... I mean to the lowest bidder.
In Britain you have to put an X inside the box next to the the candidates name. If the X even touches the
box, then that vote is declared spoiled, and the ballot slip is thrown away. If something other than an X is
used, then the ballot is spoiled and the ballot slip is thrown away.
But that is UnAmerican. You would be depriving some [insert political party] canidate their God-given right cheat, lie, manipulate, recount, and sue if the election doesn't go their... err... I mean ask for a fair and impartial election.
Power attracts the corruptable. Absolute power attracts the absolutely corruptable.
Hopefully Linux distributors will see this as an oppotunity to convince consumers and managers to swicth from MS products. As consumers and managers become more disillusioned with the forced upgrade syndrome and the ever rising costs of products/lisences, there may be a rush to Linux at some point in the future. Linux distros need to start polishing up a few things to get ready for this potential.
1. Distribute a REAL(TM) Workstation version of Linux. As it stands now, every computer can potentially be a webserver, DNS server, mailserver, etc. Joe User doesn't need the these on his computer. Where I work, this has been a big reason why Linux was not replaced the desktop (yes, you can choose not to install them, but try convincing the PHB).
2. Provide a secure by default install. No need to go into further detail. Now that Jay Beale is working with MandrakeSoft, hopefully they will set an example for others to follow.
3. Polish up the Desktop. It doesn't matter whether it's KDE or Gnome, as long as it is functional and somewhat BugFree(TM).
4. Polish up the would be replacements to MS Office. This is the key converting a majority of the consumers and managers. Unfortunately, the world is addicted to MS Office. They need to be shown that MS Office can be replaced.
The polititions are turning this whole thing into a Three Ring Circus. OJ proved you could get away with murder, if you have a good lawyer. Is Bush and Gore trying to prove that the only thing you need to become president is a good lawyer? Can you sue to become president? If events continue the way they are, we may find out.
I like Gore's new math, recount until the total comes out to something more favorable. Who really believes that a recount is anymore accurate than the original tally? [conspiracy theory] Out of the 6 million votes in Florida, how hard do you think it would be for Gore supporters to mysteriously come up with 2000 votes in Gore's favour? [/conspiracy theory]
If this information can be used obtained through FOI, then I expect lawyers will start requesting this information more often. I fear this information will be used in smear campaigns for no other reason than to dicredit the individual.
Lawyer in court: On this day, [insert date], you downloaded 150 pictures from www.kinkysex.com...
Still is... at least until North Korea perfects it's multi-stage ICBM and uses Hawaii as a Firing Range.
I lived there at one time. Voting in Hawaii is a little annoying. The TV networks have already perdicted the winner before half of the state gets a chance to vote. It makes voting seem pointless when you know you are voting for the loser.
UU.NET dial-up servers are used by a few large ISP's. MSN is the largest ISP I know of that uses UU.NET. So an MSN customer will get an IP which will point back to a UU.NET server. Unless the spammers put an MSN email address in the SPAM, there is really no way of determining which ISP is being used (Unless UU.NET looks at their logs).
In the small town I live in, four different ISP's that I know of use the same UU.NET dial-up server. The only difference is on the users end when they dial-up. Logins are [ISP code]/[user login] (i.e. - MSN/luser). There is no way to effectively add UU.NET to RBL because a LARGE chunk of IP's would be blocked.
The FBI managed to get a search warrant based on logs from a firewall, that showed my IP only connecting, not even logging in, hours after news of the cracking had appeared on news sites.
Are you sure the search warrent was based off of firewall logs? Did they tell you this?
From what I've seen, most of the crackers/script kiddies they catch are based off of "evidence" they find on IRC chat logs. A web site gets defaced, you talk about how you think it was done on IRC, and it appears you judgement is right. The feds take a shotgun approach to solving the crime and you get caught in the process (whether you did it or not). Are you really surprised they came knocking on your door?
When are people going to learn that there are some subjects which they SHOULD NOT DISCUSS on IRC, no matter how innocent they are? Consider them TABOO!! Those discussions can be used as circumstantial evidence, whether it's true or not. As wrong as it sounds, the FBI is going to place the burden of proof on you (and your computer).
So your server doesn't lock up from having too many half-open connections. But someone can still fill up the pipe. It's still a DOS if nobody can connect to your server, regardless of the actual state of your server.
"On-board e-mail and Internet capability is inevitable for the airline industry," said Kent Craver, manager of on-board product marketing for Continental Airlines Inc.. "We're just not sure how and when."
It sounds like someone in management said "Make it happen!" This means the implementation will be haphazardly thrown together. We already have problems with Laptops and portable radios interfering with the radio navigation used by airplanes. I can imagine the new problems this may cause.
He starts off talking about e-books, bashes Big Business and Publishing, spends most of the article talking writing styles, and then asks if e-books will replace their physical counterparts.
Huh? Did anyone else have trouble following the article? And his point was...?
Slashdot Mirror
Wed Jan 10 12:46:50 PST 2001
(* security fix *)
glibc-2.2 contains a local vulnerability that affects all setuid root binaries. Any user on affected systems will be able to read any file on the system through a simple process: The user sets the RESOLV_HOST_CONF environment variable to the name of the file that they wish to read, then runs any setuid root program that makes use of that variable. The file is then written to stderr.
a1/glibcso.tgz: Patched sysdeps/generic/unsecvars.h to fix the problem with RESOLV_HOST_CONF, and also to add HOSTALIASES to the list. (this change is noted in glibc-CVS)br> d1/glibc.tgz: Patched sysdeps/generic/unsecvars.h as above.
Announcing Slackware Linux 7.1!
The first major release for 2000, Slackware Linux 7.1 builds...
Until that file announces Slackware 7.2, it has NOT been released. It hasn't even been released as beta yet!! Do you think any major distro would release something without releasing a beta beforehand?
What it looks like is happening is Patrick and the rest of the Slackware developers are preparing slackware-current, Slackware's developers release, to be released as a beta. This story on USENET, ummm I mean /., is a little premature.
Someone like William Hewlett dies and all you can say is this?
You need to be taken out back and beaten senseless with a LART.
Oh really? Is this like the time he said that in 1999 about 2.4? Not bashing or anything, I think Linus should release when he thinks it's ready, I'm just saying that you might want to bet on it (ha ha).
It just means you should add a year to whatever you bet is. (Or to whatever Linus announces as the expected release date)
At least I know I'm still going to get a pay check...
Stiledot
You mean there is something else besides vi!?!
vi vs. emacs
What is this computer used for?
Then try to answer that question. People don't attach computers to the internet for no reason. What services is it running? If it's an ftp server, what files are available? Is it a webserver? Look at the webpage. If ftp services are being provided but the ftp directory is empty or the webpage has is the default one install with the OS, then something is up.
Check for user activity. Are there any users? Goto ~/.netscape (if the machine is unix). What are the timestamps on the files. Does the user have any email. By looking at the appropriate files (depending on OS) you can tell when it was installed. Has anything changed since then? Do a find on files changed over the last seven days. If there is no user activity, something is definitly wrong!!
Check for changes made to configuration files. Check the files that a sysadmin would most likely change. If you can't find any changes (other than LOTS of logging - another Red Flag!), check to see if the system looks like a default install (if you are into this, you should know what default installs look like/the common security holes the vendor leaves open/etc.). If it is a default install and the install is older than a week, congratulations, you've found a Honey Pot.
One last check before getting the hell out of dodge, sniff the network. Who else is one it? Honey Pots tend to be isolated. If the only activity you see is yourself (unless you are connected at midnight, but then you deserve to get caught) or the only other traffic is logging activity (from the one you are on to somewhere else), You've been had!! Just for shits and grins, ping the subnet you are on. People and companies don't waste network equipment as it is fairly expensive. If the machine you are on is the only one on that subnet....
do a quick `rm -rf /` and never go back.
All three need to be recognized and applauded for their efforts and commitment to the community.
Thanks. I couldn't remember.
Post hoc ergo propter hoc - "after this, therefore because of this"
You are assuming cause-and-effect relationships were there are none. You are assuming one event presedes the other, the first being the cause of the second. i.e. - you are making shit up that has no possible way of being related to one another or being true.
"Assumption is the mother of all fuckups." - quote from some movie.
When people start using "logic" as an argument, they usually have no idea what logic is themselves.
Hemos seems to have a problem with reading comprehension. He gets todays Short Bus Award. For those interested in what's the ruling means, CNN has a better explanation.
Several of my friends have written slashdot off as a waste of time. I'm starting to agree with them.
But that is UnAmerican. You would be depriving somebody of their God-given right to contract out the making of ballots for [insert state] to their brother... err... I mean to the lowest bidder.
In Britain you have to put an X inside the box next to the the candidates name. If the X even touches the box, then that vote is declared spoiled, and the ballot slip is thrown away. If something other than an X is used, then the ballot is spoiled and the ballot slip is thrown away.
But that is UnAmerican. You would be depriving some [insert political party] canidate their God-given right cheat, lie, manipulate, recount, and sue if the election doesn't go their... err... I mean ask for a fair and impartial election.
Power attracts the corruptable. Absolute power attracts the absolutely corruptable.
1. Distribute a REAL(TM) Workstation version of Linux. As it stands now, every computer can potentially be a webserver, DNS server, mailserver, etc. Joe User doesn't need the these on his computer. Where I work, this has been a big reason why Linux was not replaced the desktop (yes, you can choose not to install them, but try convincing the PHB).
2. Provide a secure by default install. No need to go into further detail. Now that Jay Beale is working with MandrakeSoft, hopefully they will set an example for others to follow.
3. Polish up the Desktop. It doesn't matter whether it's KDE or Gnome, as long as it is functional and somewhat BugFree(TM).
4. Polish up the would be replacements to MS Office. This is the key converting a majority of the consumers and managers. Unfortunately, the world is addicted to MS Office. They need to be shown that MS Office can be replaced.
I like Gore's new math, recount until the total comes out to something more favorable. Who really believes that a recount is anymore accurate than the original tally? [conspiracy theory] Out of the 6 million votes in Florida, how hard do you think it would be for Gore supporters to mysteriously come up with 2000 votes in Gore's favour? [/conspiracy theory]
(Score:-1, Bush Sympathizer)
Lawyer in court: On this day, [insert date], you downloaded 150 pictures from www.kinkysex.com ...
I lived there at one time. Voting in Hawaii is a little annoying. The TV networks have already perdicted the winner before half of the state gets a chance to vote. It makes voting seem pointless when you know you are voting for the loser.
In the small town I live in, four different ISP's that I know of use the same UU.NET dial-up server. The only difference is on the users end when they dial-up. Logins are [ISP code]/[user login] (i.e. - MSN/luser). There is no way to effectively add UU.NET to RBL because a LARGE chunk of IP's would be blocked.
Are you sure the search warrent was based off of firewall logs? Did they tell you this?
From what I've seen, most of the crackers/script kiddies they catch are based off of "evidence" they find on IRC chat logs. A web site gets defaced, you talk about how you think it was done on IRC, and it appears you judgement is right. The feds take a shotgun approach to solving the crime and you get caught in the process (whether you did it or not). Are you really surprised they came knocking on your door?
When are people going to learn that there are some subjects which they SHOULD NOT DISCUSS on IRC, no matter how innocent they are? Consider them TABOO!! Those discussions can be used as circumstantial evidence, whether it's true or not. As wrong as it sounds, the FBI is going to place the burden of proof on you (and your computer).
Everyone knows that there is only one number: 42!!
If we can't take care of the one we are on NOW, how in the @#$%* are we going to make a different planet inhabitable?
Lameness filter encountered. Post aborted. Ascii Art. How creative. Not here though.
What ever!
All I was doing was trying to show how to use a slant bar in morse code. Slant bar: dah dit dit dah dit
Now why can't I post that using a series of dots and dashes?
So your server doesn't lock up from having too many half-open connections. But someone can still fill up the pipe. It's still a DOS if nobody can connect to your server, regardless of the actual state of your server.
It sounds like someone in management said "Make it happen!" This means the implementation will be haphazardly thrown together. We already have problems with Laptops and portable radios interfering with the radio navigation used by airplanes. I can imagine the new problems this may cause.
I can't wait to see the headlines:
Hackers Take Control of Airplane While in Flight
Let's see if I get this straight:
He starts off talking about e-books, bashes Big Business and Publishing, spends most of the article talking writing styles, and then asks if e-books will replace their physical counterparts.
Huh? Did anyone else have trouble following the article? And his point was...?