full-disclosure - SSH Exploit Request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200311132043.hADKhUxs009670@localhost.localdomain>
From: phantasm at textbox.net (Robert Davies)
Subject: SSH Exploit Request 

> -----Original Message-----
**snip**
> Actually, the *original* problem was that the OP *wanted* to 
> apply the patch to fix a flawed service, but was prevented 
> from doing so by a flawed policy.
> 
> Now tell me - would *you* install the patch anyhow, knowing 
> that (possibly) doing so without all the change-control 
> paperwork being done correctly would mean your ass would be 
> canned and you'd be looking for another job?

That is dependant on the seriousness taken to network security. I for one
feel that the less time a vulnerable service is open, the less time someone
can move in and exploit it.

I know, I may sound like a dick, but when it comes down to it, after testing
the patch on a non-production machine and verification that the service is
working properly, that is all the time needed to patch a flawed service.

Maybe in large corporate environments, all the restrictions and flawed
policies cause more problems then needed, but in that case, I really would
not want to see them cry that they have been comprimised because they take
their time with paperwork. 

I feel I would rather justify downing a service for one minute then having
to explain why the system has to be taken offline for a few days while the
drive is cloned and an attack is researched. 

I do apologize for assuming those that do not do the appropriate research
and patching in a timely manner lazy, whereas its possibly the suits and
policy writers that are definitely more to blame. IMO, I would do the
patching as soon as I found the patched service suitable, and if I lost my
job, at least I know that's one more machine that was secure under my
control. I'd rather tell a prospective employer that I was canned for taking
security precaustions then canned for having a critical machine comprimised.

Once again, my apologies for getting all worked up over this, I just hate to
see when suits slow down proper and prompt security precautions and then cry
about being comprimised before they cut through the red tape.

RKD