Guardian Digital Inc. >
Mailing List Archives >
Full Disclosure Mailing List Archive
Paul Laudanski wrote:
> On Sat, 25 Dec 2004, Raistlin wrote:
>>Juergen Schmidt wrote:
>>>the new santy version not only attacks phpBB.
>>How would these two worms react to classical hardening tips such as PHP
>>Safe mode and noexec /tmp ?
> For this particular strain it would certainly help, but that is why there
> exists new variations. Certainly doing it to /tmp, /usr/tmp, /var/tmp
> could help, but it isn't 100% foolproof, and some don't even consider it
It only protects you from exploits that cannot just go;
or other, equivalent methods.
ie its only effective against directly executing files on those
filesystems; you can still use other methods to run them.
Full-Disclosure - We believe in it.