lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20080911021647.GA22553@baea.com.au>
Date: Thu, 11 Sep 2008 11:46:47 +0930
From: Brett Lymn <blymn@...systems.com.au>
To: Florian Weimer <fw@...eb.enyo.de>
Cc: Theo de Raadt <deraadt@....openbsd.org>,
	B 650 <dunc.on.usenet@...glemail.com>, bugtraq@...urityfocus.com
Subject: Re: Sun M-class hardware denial of service

On Wed, Sep 10, 2008 at 09:01:05PM +0200, Florian Weimer wrote:
> 
> > How absolutely bizzare.  Basically you spend half a million dollars on
> > Sun hardware, and it isn't required to do this better than VMWare?
> 
> I think you've got it exactly backwards: you don't let non-trusted
> people run code on these machines because they are so expensive.
> 

Right, and even if you are forced to allow root access to someone who
is not well trusted then run them in a zone on the hardware domain -
that way they cannot load random kernel modules even if they have root
in the zone.

The bug is bad but there are workarounds available that make it very
difficult to exploit.

-- 
Brett Lymn
"Warning:
The information contained in this email and any attached files is
confidential to BAE Systems Australia. If you are not the intended
recipient, any use, disclosure or copying of this email or any
attachments is expressly prohibited.  If you have received this email
in error, please notify us immediately. VIRUS: Every care has been
taken to ensure this email and its attachments are virus free,
however, any loss or damage incurred in using this email is not the
sender's responsibility.  It is your responsibility to ensure virus
checks are completed before installing any data sent in this email to
your computer."


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ