....
 

Guardian Digital Inc. > InfoCenter > Mailing List Archives > Full Disclosure

Full Disclosure Mailing List Archive

From: Steve Wray (steve@myself.gen.nz)
Date: Sun Dec 26 2004 - 15:32:00 EST


Paul Laudanski wrote:
> On Sat, 25 Dec 2004, Raistlin wrote:
>
>>Juergen Schmidt wrote:
>>
>>>Hello,
>>>
>>>the new santy version not only attacks phpBB.
>>
>>How would these two worms react to classical hardening tips such as PHP
>>Safe mode and noexec /tmp ?
>
> For this particular strain it would certainly help, but that is why there
> exists new variations. Certainly doing it to /tmp, /usr/tmp, /var/tmp
> could help, but it isn't 100% foolproof, and some don't even consider it
> security.

It only protects you from exploits that cannot just go;

source /tmp/rootkit.sh

or other, equivalent methods.

ie its only effective against directly executing files on those
filesystems; you can still use other methods to run them.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html



[ About Guardian Digital ] - [ Press Center ] - [ Contact Us ] - [ System Activation ] - [ Reseller Info ] - [ Online Store ] - [ Site Map ]
Copyright (c) 2000 - 2004 Guardian Digital, Inc. Linux Lockbox and EnGarde are Trademarks of Guardian Digital, Inc.