full-disclosure - No shell => secure?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <s0f25b5e.072@aaoffc01.questar.com>
From: jcreegan at questarweb.com (John Creegan)
Subject: No shell => secure?

In one sense I agree this would protect you from any virus, considering that /bin is in the path environment variable, and that the system startup scripts use it.  Without making changes to all those, you wouldn't have much of a system.  Without /bin in the path, a lot of stuff is gonna break.

>>> Matthias Benkmann <matthias@...terdrache.de> 07/09/04 03:41PM >>>
Since everybody seems to insist on misunderstanding me I'll try another
approach:

There have been several Linux worms in the past. One of them is
Linux.Slapper. Would my path-renaming scheme have prevented my system from
getting infected?

http://securityresponse.symantec.com/avcenter/venc/data/linux.slapper.worm.html 

says:"This code requires the presence of the shell command /bin/sh to
properly execute."

So the answer is "Yes, the path-renaming scheme would have protected my
system against infection from Linux.Slapper."

So I have one example to back up my claim. Now it's your turn. Give me a
worm that my scheme would not have protected me against. That's all you
need to do to convince me. Easy, isn't it? No need to give me lengthy
lectures. Just give me one URL. If you can't do that, don't bother
replying. You're wasting your time, because you're telling me things I
already know.

MSB

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

This message (including any attachments) contains confidential 
information intended for a specific individual and purpose, 
and is protected by law.  If you are not the intended recipient,
you should delete this message and are hereby notified that any 
disclosure,copying, or distribution of this message, or the taking 
of any action based on it, is strictly prohibited.