full-disclosure - Re: New Santy-Worm attacks *all* PHP-skripts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <41CF1FC0.8010303@myself.gen.nz>
From: steve at myself.gen.nz (Steve Wray)
Subject: Re: New Santy-Worm attacks *all* PHP-skripts

Paul Laudanski wrote:
> On Sat, 25 Dec 2004, Raistlin wrote:
> 
>>Juergen Schmidt wrote:
>>
>>>Hello,
>>>
>>>the new santy version not only attacks phpBB.
>>
>>How would these two worms react to classical hardening tips such as PHP 
>>Safe mode and noexec /tmp ?
> 
> For this particular strain it would certainly help, but that is why there 
> exists new variations.  Certainly doing it to /tmp, /usr/tmp, /var/tmp 
> could help, but it isn't 100% foolproof, and some don't even consider it 
> security.  

It only protects you from exploits that cannot just go;

source /tmp/rootkit.sh

or other, equivalent methods.

ie its only effective against directly executing files on those 
filesystems; you can still use other methods to run them.