Mailing-List:	contact cygwin-help AT sourceware DOT cygnus DOT com; run by ezmlm
List-Subscribe:	<mailto:cygwin-subscribe AT sources DOT redhat DOT com>
List-Archive:	<http://sources.redhat.com/ml/cygwin/>
List-Post:	<mailto:cygwin AT sources DOT redhat DOT com>
List-Help:	<mailto:cygwin-help AT sources DOT redhat DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender:	cygwin-owner AT sources DOT redhat DOT com
Delivered-To:	mailing list cygwin AT sources DOT redhat DOT com
Date:	Tue, 10 Jul 2001 19:29:40 +0400
From:	egor duda <deo AT logos-m DOT ru>
X-Mailer:	The Bat! (v1.53 RC/4)
Reply-To:	egor duda <cygwin AT cygwin DOT com>
Organization:	deo
X-Priority:	3 (Normal)
Message-ID:	<13097881035.20010710192940@logos-m.ru>
To:	Corinna Vinschen <cygwin AT cygwin DOT com>
Subject:	Re: inetd security issues
In-Reply-To:	<20010710172216.S8578@cygbert.vinschen.de>
References:	<5 DOT 0 DOT 2 DOT 1 DOT 0 DOT 20010710214050 DOT 00ad6308 AT mail DOT sprintsoft DOT com>
	<20010710172216 DOT S8578 AT cygbert DOT vinschen DOT de>
MIME-Version:	1.0

Hi!

Tuesday, 10 July, 2001 Corinna Vinschen cygwin AT cygwin DOT com wrote:

CV> Using Cygwin is not secure at all. If you or your admin has
CV> honest security concerns don't open up the system by providing
CV> services via inetd

actually, i'm not aware of any _remotely_ exploitable holes in cygwin
inetutils. do anybody?

yes, cygwin process can be easily exploited locally, it's a known
problem (or, rather a bunch of problems). But if someone finds a
remotely exploitable hole in, say, ftpd, of sshd, it's equally drastic
for cygwin and for any unix -- both on cygwin and unices those daemons
usually run as root.

Egor.            mailto:deo AT logos-m DOT ru ICQ 5165414 FidoNet 2:5020/496.19


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

- Raw text -