miq@chromavac.SGI.COM (Miq Millman) (11/08/88)
M 'IE<F\@<V5C;VYD<P E9"L )3 R9#HE,#)D.B4P,F0 +" E9"!W965K)7,
M ', +" E9"!D87DE<P <P L("5D(&AO=7(E<P <P L("5D(&UI;G5T925S
M !S "P@)60@<V5C;VYD)7, ', 0"@C*79E<G-I;VXN8PDU+C4R("A"97)K
M96QE>2D@-2\V+S@V U+C4R D2&5A9&5R.B O:F%K92]A='0O=7-R+W-R
M8R]C;60O<V5N9&UA:6PO<W)C+U)#4R]A;&EA<V9E=&-H+F,L=B Q+C$@.#<O
M,#8O,C(@,3 Z,C$Z,S(@=FIS($5X<" D
M
M
M
M
M
M ! "'-@ "*P!M86EL+F%L:6%S97, 65!?3$%3
M5%]-3T1)1DE%1 E,#$P9 !94%]-05-415)?3D%-10 ! *",I9V5T<'=E
M;G0N8R Q+C$@.#8O,#(O,#,@0V]P>7(@,3DX-"!3=6X@36EC<F\
M
M
M
M
M
M
M O971C+W!A<W-W9
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M <V5T<'=E;G0Z(&=E=&1O;6%I;FYA;64@<WES=&5M(&-A
M;&P@;6ES<VEN9PH <@!G971P=V5N=#H@9V5T9&]M86EN;F%M92!S>7-T96T@
M8V%L;"!M:7-S:6YG"@!R "L *@ J "L *P!P87-S=V0N8GEN86UE '!A<W-W
M9"YB>6YA;64 <&%S<W=D+F)Y;F%M90 E9 !P87-S=V0N8GEU:60 0"@C*6=E
M=&AO<W1E;G0N8R Q+C$@.#8O,#(O,#,@($-O<'ER(#$Y.#0@4W5N($UI8W)O
M
M
M
M
M
M O
M971C+VAO<W1S
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M 6AO<W1S+F)Y861D<@!H;W-T
M<RYB>6YA;64 <V5T:&]S=&5N=#H@9V5T9&]M86EN;F%M92!S>7-T96T@8V%L
M;"!M:7-S:6YG"@!R '( :&]S=',N8GEA9&1R &AO<W1S+F)Y861D<@ C"@ @
M"0 @"0 @"0!G971H;W-T96YT.B!G971D;VUA:6YN86UE('-Y<W1E;2!C86QL
M(&UI<W-I;F<* $ H(REG971N971G<F5N="YC(#$N,2 X-B\P,B\P,R!#;W!Y
M<B Q.3@U(%-U;B!-:6-R;P
M
M
M
M
M
M
M
M
M
M
M 9V5T
M;F5T9W)E;G0Z(&=E=&1O;6%I;FYA;64@<WES=&5M(&-A;&P@;6ES<VEN9PH
M0WEC;&4@9&5T96-T960@:6X@+V5T8R]N971G<F]U<#H@)7,N"@ @"0HC " )
M '-Y;G1A>"!E<G)O<B!I;B O971C+VYE=&=R;W5P"@ M+2T@)7,* &YE=&=R
M;W5P 0"@C*6=E='-E<G9E;G0N8R Q+C$@.#8O,#(O,#,@($-O<'ER(#$Y
M.#0@4W5N($UI8W)O
M
M
M
M
M
M O971C+W-E<G9I8V5S
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M 7-E='-E<G9E;G0Z(&=E=&1O;6%I;FYA;64@
M<WES=&5M(&-A;&P@;6ES<VEN9PH <@!R '-E<G9I8V5S+F)Y;F%M90!S97)V
M:6-E<RYB>6YA;64 (PH ( D +"\ ( D ( D 9V5T<V5R=F5N=#H@9V5T9&]M
M86EN;F%M92!S>7-T96T@8V%L;"!M:7-S:6YG"@ 0"@C*6EN;F5T9W(N8R Q
M+C$@.#8O,#(O,#,@0V]P>7(@,3DX-2!3=6X@36EC<F\
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M
M &EN;F5T9W(Z(&=E=&1O;6%I;FYA
M;64@<WES=&5M(&-A;&P@;6ES<VEN9PT* &YE=&=R;W5P+F)Y=7-E<@!N971G
M<F]U<"YB>6AO<W0 :6YN971G<CH@<F5C=7)S:79E(&]V97)F;&]W#0H ;F5T
M9W)O=7 :6YN971G<CH@;F5T9W)O=7 @)7,@8V%L;&5D(')E8W5R<VEV96QY
M#0H :6YN971G<CH@<WEN=&%X(&5R<F]R(&EN("]E=&,O;F5T9W)O=7 -"@!I
M;FYE=&=R.B!S>6YT87@@97)R;W(@:6X@+V5T8R]N971G<F]U< T* &EN;F5T
M9W(Z('-Y;G1A>"!E<G)O<B!I;B O971C+VYE=&=R;W5P#0H ( D*(P @"0 J
M ! *",I>7!?8FEN9"YC(#$N,2 X-B\P,B\P,R!#;W!Y<B Q.3@U(%-U;B!-
M:6-R;P % '@ > 4 %
M
M
M
M
M
M &QO
M861?9&]M7V)I;F1I;F<Z("!M86QL;V,@9F%I;'5R92X* $ H(REY<%]E;G5M
M+F,@,2XQ(#@V+S R+S S($-O<'ER(#$Y.#4@4W5N($UI8W)O %E07P #
M0"@C*7EP7VUA=&-H+F,@,2XQ(#@V+S R+S S($-O<'ER(#$Y.#4@4W5N($UI
M8W)O $ H(REY<'!R;W1?97)R+F,@,2XQ(#@V+S R+S S($-O<'ER(#$Y
M.#4@4W5N($UI8W)O ! *",I>7!V,5]X9'(N8R Q+C$@.#8O,#(O,#,@0V]P
M>7(@,3DX-2!3=6X@36EC<F\ $ 2]@ @ !+Z@ # $SF/__
M__\ 0 !,%( " $PB@ , 3.8_____P $ H(REY
M<'AD<BYC(#$N,2 X-B\P,B\P,R!#;W!Y<B Q.3@U(%-U;B!-:6-R;P !
M $S$@ ( 4GJ_____P $ H(REC;&YT7W5D<"YC(#$N,2 X-B\P
M,B\P,R!#;W!Y<B Q.3@T(%-U;B!-:6-R;P $W !.B( 3G& $Y\ !
M.B1C;&YT=61P7V-R96%T93H@;W5T(&]F(&UE;6]R>0H 8VQN='5D<%]C<F5A
M=&4Z(&]U="!O9B!M96UO<GD* $ H(REP;6%P7V-L;G0N8R Q+C$@.#8O,#(O
M,#,@0V]P>7(@,3DX-"!3=6X@36EC<F\ !0 \
M !#86YN;W0@<F5G:7-T97(@<V5R=FEC90!G971?;7EA9&1R
M97-S.B!S;V-K970 9V5T7VUY861D<F5S<SH@:6]C=&P@*&=E="!I;G1E<F9A
M8V4@8V]N9FEG=7)A=&EO;BD 9V5T7VUY861D<F5S<SH@:6]C=&P 0"@C*7!M
M87!?9V5T<&]R="YC(#$N,2 X-B\P,R\P,B!#;W!Y<B Q.3@T(%-U;B!-:6-R
M;P !0 \ 0"@C*7!M87!?<')O="YC(#$N,2 X-2\P
M-2\S,"!#;W!Y<B Q.3@T(%-U;B!-:6-R;P $ H(RER<&-?<')O="YC(#$N
M,2 X-B\P,B\P,R!#;W!Y<B Q.3@T(%-U;B!-:6-R;P !0%H !
M % W/____\ ! *",I>&1R+F,@,2XQ(#@V+S R+S S($-O<'ER(#$Y
M.#0@4W5N($UI8W)O >&1R7V)Y=&5S.B!O=70@;V8@;65M;W)Y
M"@!X9')?<W1R:6YG.B!O=70@;V8@;65M;W)Y"@ ! *",I>&1R7VUE;2YC
M(#$N,2 X-2\P-2\S,"!#;W!Y<B Q.3@T(%-U;B!-:6-R;P 4[. %._ !
M3RH 4]L %/K@ !3\@ 5 2 %.S$ H(REX9')?<F5F97)E;F-E+F,@,2XQ
M(#@U+S U+S,P($-O<'ER(#$Y.#0@4W5N($UI8W)O 'AD<E]R969E<F5N8V4Z
M(&]U="!O9B!M96UO<GD* $ H(REA=71H7VYO;F4N8R Q+C$@.#8O,#(O,#,@
M0V]P>7(@,3DX-"!3=6X@36EC<F\ %1\ !4<8 5'R %1_ !4@8
M
M ! *",I8VQN=%]P97)R;W(N8R Q+C$@.#4O,#4O
M,S @0V]P>7(@,3DX-"!3=6X@36EC<F\ )7,Z( [(&5R<FYO(#T@)7, .R!E
M<G)N;R ]("5S #L@;&]W('9E<G-I;VX@/2 E;'4L(&AI9V@@=F5R<VEO;B ]
M("5L=0 [('=H>2 ]( !!551(7T]+ $%55$A?0D]'55-?0U)%1$5.5$E!3 !!
M551(7U)%2D5#5$5$7T-2141%3E1)04P 05542%]"3T=54U]615))1DE%4@!!
M551(7U)%2D5#5$5$7U9%4DE&2452 $%55$A?5$]/7U=%04L@*')E;6]T92!E
M<G)O<BD 05542%])3E9!3$E$7U)%4U!/3E-% $%55$A?54Y+3D]73E]&04E,
M55)% #L@;&]W('9E<G-I;VX@/2 E;'4L(&AI9V@@=F5R<VEO;B ]("5L=0!2
M4$-?54Y+3D]73E]&04E,55)%.R!S,2 ]("5L=2P@<S(@/2 E;'4 "@!24$-?
M4U5#0T534P!24$-?0T%.5%]%3D-/1$5?05)'4P!24$-?0T%.5%]$14-/1$5?
M4D5354Q44P!24$-?0T%.5%]314Y$ %)00U]#04Y47U)%0U8 4E!#7U1)345$
M7T]55 !24$-?5D524TE/3E]-25--051#2 !24$-?05542%]%4E)/4@!24$-?
M4D5-3U1%7U!23T=204U?54Y!5D%)3$%"3$4 4E!#7U!23T=204U?34E334%4
M0T@ 4E!#7U5.2TY/5TY?4%)/0T5$55)% %)00U]#04Y47T1%0T]$15]!4D=3
M %)00U]53DM.3U=.2$]35 !24$-?4$U!4%]&04E,55)% %)00U]04D]'7TY/
M5%]214=)4U1%4D5$ %)00U]365-414U?15)23U( )7,Z( @+2 ("T@)7,
M"@ ! *",I:6YE=%]A9&1R+F,)-2XQ("A"97)K96QE>2D@-2\S,"\X-0
M0"@C*6EN971?;G1O82YC"34N,2 H0F5R:V5L97DI(#4O,S O.#4
M "5D+B5D+B5D+B5D +V1E=B]L;V< "]D978O8V]N
M<V]L90 _____P H=@ _P AS>7-L;V< /"5D/@ E+C$U<R
M6R5D70 Z( !E<G)O<B E9 - 0"@C*61B;2YC"34N,R H0F5R:V5L97DI
M(#@U+S X+S$U !D8FTZ(&YO(&]P96X@9&%T86)A<V4* $ H(REN
M9&)M+F,)-2XR("A"97)K96QE>2D@-B\Q.2\X-0 ] .0 #4 Q
M +0 "D E (0 !T 9 %0 !$ - "0 4
M !,0#2OS$8X]XTJQ-R* >H1Q8S]68A0[-9)M5DB#N>;UDW=596,(G*>QCI
M+84,T.G8&IX[5#ZJD"\-F_JN+S*T6S'M80(]/(.8%&9@XP^-2W8"QWI?%&R'
MF1Q']1\DGX\V)'<@0Q^\'DT>AK/Z-]\VIA;M,.0"PQ2.(6Y9*08VLTXQ?Y]6
M%?"=<!,0)OLXQX2Q*:PS!2M(7<4\!)W<-:G[S3'5-SLK)&>9"BDCTPBI;ITP
M QJ?"/4EM3-A' 8D"=N8#*3^LA MQXP5FXR.41],1E.-U(((SJ5#SC^-BG'
MS5</>SHY,HZ*%AY]$X@/NGCU)TQ^?!Z+YEPOH+"['K;#<2YP86< +F1I<@!N
M9&)M.B!S<&QI="!N;W0@<&%I<F5D"@ $90 0 "B=H HG>
M ? ' !\ > 'P !X
M ? 'P !X ? '@ !\ % !30 #H $O
M 15-4 $5$5 !$87D@36]N
M(# P(# P.C P.C P(#$Y,# * %-U;DUO;E1U95=E9%1H=49R:5-A= !*86Y&
M96)-87)!<')-87E*=6Y*=6Q!=6=397!/8W1.;W9$96, 5%H !R
M +V5T8R]U=&UP "]E=&,O=71M<
M +V1E=B\ $
M 0= !!4 $ D 0 !!T $%0
M 0"0 _\ $ 4 1^___]____\
M $'0 /A !_N9F9F9F9G7^YF9F9F9F=
M #_@ /_ _X 56YK;F]W;B!E
M<G)O<B E9 Z( * 56YU<V5D HS( *,T "C-H HST *-! "
MC1P HTF *-0 "C5( HUD *-= "C8< HV9 *-J@ "C;P HW( *-
MW@ "C>H HWV *." "CA< HXG *.-@ "CD< HY; *.;P "CH HZ/
M *.G@ "CK8 H[# *.V0 "CN@ H[T */"P "CQP H\R */3 "CVH
M H^) */I@ "C[< H_6 */[0 "D 0 I > *00 "D%X I". *0I0 "
MD,0 I#4 *0ZP "D0\ I$P *120 "D6, I%_ *1EP "D;@ I': *1
M[P "D@( I(D *2-P "DD0 I)8 *2; "DH< I*: *2K@ "DL0 I+F
M *2^@ "DQ4 I,M *32@ "BV HM@ *+8 "DUT I-P *3B@ "DYX
M I.P *3O@ "D]8 !717)R;W(@, !.;W0@;W=N97( 3F\@<W5C:"!F:6QE
M(&]R(&1I<F5C=&]R>0!.;R!S=6-H('!R;V-E<W, 26YT97)R=7!T960@<WES
M=&5M(&-A;&P 22]/(&5R<F]R $YO('-U8V@@9&5V:6-E(&]R(&%D9')E<W,
M07)G(&QI<W0@=&]O(&QO;F< 17AE8R!F;W)M870@97)R;W( 0F%D(&9I;&4@
M;G5M8F5R $YO(&-H:6QD('!R;V-E<W-E<P!.;R!M;W)E('!R;V-E<W-E<P!.
M;W0@96YO=6=H('-P86-E %!E<FUI<W-I;VX@9&5N:65D $)A9"!A9&1R97-S
M $)L;V-K(&1E=FEC92!R97%U:7)E9 !$979I8V4@8G5S>0!&:6QE(&5X:7-T
M<P!#<F]S<RUD979I8V4@;&EN:P!.;R!S=6-H(&1E=FEC90!.;W0@82!D:7)E
M8W1O<GD 27,@82!D:7)E8W1O<GD 26YV86QI9"!A<F=U;65N= !&:6QE('1A
M8FQE(&]V97)F;&]W %1O;R!M86YY(&]P96X@9FEL97, 3F]T(&$@='EP97=R
M:71E<@!497AT(&9I;&4@8G5S>0!&:6QE('1O;R!L87)G90!.;R!S<&%C92!L
M969T(&]N(&1E=FEC90!);&QE9V%L('-E96L 4F5A9"UO;FQY(&9I;&4@<WES
M=&5M %1O;R!M86YY(&QI;FMS $)R;VME;B!P:7!E $%R9W5M96YT(&]U="!O
M9B!D;VUA:6X 4F5S=6QT('1O;R!L87)G90!/<&5R871I;VX@=V]U;&0@8FQO
M8VL 3W!E<F%T:6]N(&YO=R!I;B!P<F]G<F5S<P!/<&5R871I;VX@86QR96%D
M>2!I;B!P<F]G<F5S<P!3;V-K970@;W!E<F%T:6]N(&]N(&YO;BUS;V-K970
M1&5S=&EN871I;VX@861D<F5S<R!R97%U:7)E9 !-97-S86=E('1O;R!L;VYG
M %!R;W1O8V]L('=R;VYG('1Y<&4@9F]R('-O8VME= !0<F]T;V-O;"!N;W0@
M879A:6QA8FQE %!R;W1O8V]L(&YO="!S=7!P;W)T960 4V]C:V5T('1Y<&4@
M;F]T('-U<'!O<G1E9 !/<&5R871I;VX@;F]T('-U<'!O<G1E9"!O;B!S;V-K
M970 4')O=&]C;VP@9F%M:6QY(&YO="!S=7!P;W)T960 061D<F5S<R!F86UI
M;'D@;F]T('-U<'!O<G1E9"!B>2!P<F]T;V-O;"!F86UI;'D 061D<F5S<R!A
M;')E861Y(&EN('5S90!#86XG="!A<W-I9VX@<F5Q=65S=&5D(&%D9')E<W,
M3F5T=V]R:R!I<R!D;W=N $YE='=O<FL@:7,@=6YR96%C:&%B;&4 3F5T=V]R
M:R!D<F]P<&5D(&-O;FYE8W1I;VX@;VX@<F5S970 4V]F='=A<F4@8V%U<V5D
M(&-O;FYE8W1I;VX@86)O<G0 0V]N;F5C=&EO;B!R97-E="!B>2!P965R $YO
M(&)U9F9E<B!S<&%C92!A=F%I;&%B;&4 4V]C:V5T(&ES(&%L<F5A9'D@8V]N
M;F5C=&5D %-O8VME="!I<R!N;W0@8V]N;F5C=&5D $-A;B=T('-E;F0@869T
M97(@<V]C:V5T('-H=71D;W=N %1O;R!M86YY(')E9F5R96YC97,Z(&-A;B=T
M('-P;&EC90!#;VYN96-T:6]N('1I;65D(&]U= !#;VYN96-T:6]N(')E9G5S
M960 5&]O(&UA;GD@;&5V96QS(&]F('-Y;6)O;&EC(&QI;FMS $9I;&4@;F%M
M92!T;V\@;&]N9P!(;W-T(&ES(&1O=VX 2&]S="!I<R!U;G)E86-H86)L90!$
M:7)E8W1O<GD@;F]T(&5M<'1Y $YO(&UE<W-A9V4@;V8@9&5S:7)E9"!T>7!E
M $ED96YT:69I97(@<F5M;W9E9 !$:7-C('%U;W1A(&5X8V5E9&5D %-T86QE
M($Y&4R!F:6QE(&AA;F1L90!4;V\@;6%N>2!L979E;',@;V8@<F5M;W1E(&EN
M('!A=&@ 26YO9&4@=&%B;&4@:7,@9G5L; !.;R!F;&]A=&EN9R!P;VEN="!H
M87)D=V%R90!'<F%P:&EC<R!A;')E861Y(&EN('5S90!.;R!G<F%P:&EC<R!H
M87)D=V%R92!P<F5S96YT %1E>'0@=&%B;&4@:7,@9G5L; !$96%D;&]C:R!C
M;VYD:71I;VX 3F\@<F5C;W)D(&QO8VMS(&%V86EL86)L90!.;W0@82!S=')E
M86T@9&5V:6-E $YO(&1A=&$@879A:6QA8FQE %1I;65R(&5X<&ER960 3W5T
M(&]F('-T<F5A;2!R97-O=7)C97, 3F]T(&$@9&%T82!M97-S86=E
M M "L ( P,3(S-#4V-S@Y04)#1$5&
M # Q,C,T-38W.#EA8F-D968 ,'@ ,%@ +0 K " +0 K "
M
M ?[F9F9F9F9U_N9F9F9F9G0
M !&D[BUM05N%P "!#0<-Y-^" !!!E]>$
M A PX@ 1 60 ) ) %
M $'0 05 ! ) $ D 0"0 !
M) $ D /_ ! ) 0"0
M (" @(" @(" @*"@H*"@@(" @(" @(" @(" @(" @("!($! 0$! 0$! 0
M$! 0$! 0A(2$A(2$A(2$A! 0$! 0$!"!@8&!@8$! 0$! 0$! 0$! 0$! 0$!
M 0$! 1 0$! 0$(*"@H*"@@(" @(" @(" @(" @(" @(" @("$! 0$"
M
M
M
M
M _W___W]___\ '2=
MQ:X @6@X;R@ !!,OKP@ "$8<0 $0L@ )!(
M 4N !!( 02 $$@ !!( 02 #^ !!( $ D
M ( $ $ NE( +90
M $ @$ +48 "U& & @
M
M
M
M
M
M
M
M
M
M
M
M *9< +4@
M
M
M
M $ 0
> #_ OH\
end
--
BLAM! BLAM! BLAM!
"Oh thank you thank you thank you" {hug}
"Maam, you are emotionally distraught, I'll contact a rape crisis center"
Miq Millman -- miq@sgi.com or {sun,decwrl,pyramid,ucbvax}!sgi!miq
415 960 1980 x1041 workroot@sbcs.sunysb.edu (root) (11/08/88)
Just a comment on the distribution medium of your updated sendmail - what prevents one of the backbone sites from modifying your fixed sendmail so as to introduce a trojan horse? I would recommend against this method of distribution, especially for a daemon that normally runs as "root". Rick Spanbauer SUNY/Stony Brook
miq@chromavac.SGI.COM (Miq Millman) (11/09/88)
In article <1795@sbcs.sunysb.edu>, root@sbcs.sunysb.edu (root) writes: > > Just a comment on the distribution medium of your updated sendmail - what > prevents one of the backbone sites from modifying your fixed sendmail so as > to introduce a trojan horse? I would recommend against this method > of distribution, especially for a daemon that normally runs as "root". > > Rick Spanbauer > SUNY/Stony Brook AS I mentioned to Mr. Spanbauer via email, there is nothing stopping it. However the possiblity of someone at a backbone site doing the following: 1) knowing EXACTLY when my message will come through his site in advance 2) knowing how many sections my post would be in advance 3) having a virus ready and waiting for a post to be made to comp.sys.sgi that included binaries and being aware of 1 & 2 4) doing all of the first three things just about the same time a worm is floating around systems is extremely rare. And as I mentioned with the 4D version of sendmail, the only real way to be safe is to remove your machine from all networks. -- BLAM! BLAM! BLAM! "Oh thank you thank you thank you" {hug} "Maam, you are emotionally distraught, I'll contact a rape crisis center" Miq Millman -- miq@sgi.com or {sun,decwrl,pyramid,ucbvax}!sgi!miq 415 960 1980 x1041 work
root@sbcs.sunysb.edu (root) (11/09/88)
In article <21798@sgi.SGI.COM>, miq@chromavac.SGI.COM (Miq Millman) writes: > AS I mentioned to Mr. Spanbauer via email, there is nothing stopping it. > However the possiblity of someone at a backbone site doing the following: > > 1) knowing EXACTLY when my message will come through his site in > advance > 2) knowing how many sections my post would be in advance > 3) having a virus ready and waiting for a post to be made to > comp.sys.sgi that included binaries and being aware of 1 & 2 > 4) doing all of the first three things just about the same time > a worm is floating around systems Look, news batches articles and sends them at a later time. So it is not as if the bad guy needs to have everything ready to go at the millisecond that your postings come through. The bad guy could hold his batching operation off until the necessary modifications were made. The bad guy could just as easily notice your posting, make the mods, forge the headers, and resubmit the article 15 days later; since you have stablished the policy of shipping binaries via Usenet people would never know they've received and installed a forgery. And the attitude of "doesn't happen, extremely rare" is what got all of us into this mess in the first place. I find it strange that an otherwise responsible manufacturer would distribute binaries via Usenet when the potential is there to introduce trojan horse mods along the way. As any IBM PC user will tell you it is simply bad practice to load any binary off a BBS and run it. Why is this point lost on Unix people? Also, why is it that you're not distributing source to sendmail? After all, the Berkeley sendmail sources are freely available. > is extremely rare. And as I mentioned with the 4D version of sendmail, the > only real way to be safe is to remove your machine from all networks. The only *real* way to be safe under Unix is to shut the machine off :-). Seriously, disconnecting from the Internet is not an option for most of us. What is SGI doing about locating and repairing other security holes in their Unix? > -- > BLAM! BLAM! BLAM! > "Oh thank you thank you thank you" {hug} > "Maam, you are emotionally distraught, I'll contact a rape crisis center" > Miq Millman -- miq@sgi.com or {sun,decwrl,pyramid,ucbvax}!sgi!miq > 415 960 1980 x1041 work Am I the only one who finds miq's .signature objectionable? Rick Spanbauer SUNY/Stony Brook
vjs@rhyolite.SGI.COM (Vernon Schryver) (11/10/88)
There are a number of ways to subvert a binary as it wanders thru the network. Another problem with posting binaries is that they are big. Finally, the Internet Police might come and break our fingers. Silicon Graphics has not in the past posted many (if any) binaries. I hope we won't have to in the future. The circumstances last week were exceptional, and there was little time. It might have been better if there had been time to write a small program which could have been used to patch the 4D binaries. We could have posted the source for such a tool. If you don't trust the posted binaries, I think the official BSD patch works with adb on 3000's, although I have not tried it. Perhaps you could attack a 4D binary on a 3000 with adb. However, the official BSD patch, which zeros the entry in the command table, does not close the security problem; it simply broke the worm. If you have played with the hole a little, you will have noticed that you can't become root with it. At least, the best I have done is UID=1 and UID=1147, though I have not spent much time at it. The sendmail problem will be fixed in a forthcoming release for 4D's. If you have sendmail source, you might want to port it, closing the hole yourself. It is a straight forward port, if a bit of a mess since IRIS's are SV with BSD extensions extended with YP, rather than straight BSD. Perhaps a way could be found to put useful binaries on a neutral archive, which could be reached via anonymous ftp. Where are the info-IRIS archives these days? Please accept our apologies if the worm, which afflicted only Suns and VAX's, caused any anxiety. In defense of the one or two of us who typed -DDEBUG in the production makefile (only 2 people come to mind, but I will not say more :-), shipping exactly what we use on our personal machines helps reduce bugs in general. In particular, I have used the debugging stuff to resolve problems on our Internet gateway. If you are at all concerned about security, stop worrying about sendmail and IMMEDIATELY install the fixes recently posted in comp.bugs.4bsd.ucp-fixes for ftpd. If you cannot do that, you should remove the user name 'ftp' from /etc/passwd. As others have said, this applies to all 4.3BSD ftp's. (The official fix for this will also be in a forthcoming 4D release.) General prudence would also have you turn off IP forwarding, to not allow outside users to login as guest, and to generally keep /etc/passwd small on your gateways. Vernon Schryver Silicon Graphics vjs@sgi.com
blbates@AERO4.LARC.NASA.GOV (Bates TAD/HRNAB ms294 x2601) (11/15/88)
I just recently got back on the network, after the virus and a system upgrade put use off. I recieved the virus fix message part 05 of 05, and was wondering what the other four messages had to say. The sendmail "fix" I have heard about and implemented, I wouldn't call a fix, but a patch. Someone needs to fix sendmail by preventing incoming mail from going into debug mode. Disabling debug mode is not an acceptable solution. I know people who have needed debug mode to get there mail working. Has anyone addressed this problem?
blbates@AERO4.LARC.NASA.GOV (Bates TAD/HRNAB ms294 x2601) (11/15/88)
We had some people here try to use adb on a 3130 to implement the
"fix", but apparently adb on the 3130's doesn't work right (We have the
3.6 OS).
I don't know where you got your information from, but we have been
told that the posting saying that only Suns and VAX's were the only
machines effected is incorrect. The word was ANY BSD machine with sendmail
compiled with the debug option was open to infection. Also what is this
about the ftpd. I haven't heard about any problems with it, would someone
please explain.blbates@AERO4.LARC.NASA.GOV (Bates TAD/HRNAB ms294 x2601) (11/15/88)
I agree to some extent. It would have been better to send a source file and a makefile, than the binaries, but then again that would have made too much sense. As far as the .signature goes, I didn't understand it, but then I guess it is beneath me.
blbates@AERO4.LARC.NASA.GOV (Bates TAD/HRNAB ms294 x2601) (11/22/88)
I didn't try using adb. We had two people try it, one was one of our
'experts' and he said adb didn't work correctly. I don't know any specifics
as to why it didn't work, but he used emacs to make the change and I copied
it to my machine.
As far as the worm was concerned, I haven't heard anythink specific,
mainly rumors. They said that it trasfered its source over to the new
machine and compiled itself. There were two ways for it to get around,
one was through sendmail and the other was through ftp. The sendmail part
could get into any BSD sendmail machine that had debug set. The ftp
portion was Sun and VAX specific, and it was the fastest part of the worm.
So we had a two headed worm; one was slow, but could get almost anywhere;
and a second that was fast, but only work on two types of machines.
One last thing, we were told NOT to put a null into the sendmail
binary, but someother value.
P.S. I am sending a copy of this to info-iris, since it has been
returned to me twice.