Mailing-List: contact cygwin-help@sourceware.cygnus.com; run by ezmlm List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@sources.redhat.com Delivered-To: mailing list cygwin@sources.redhat.com Date: Tue, 10 Jul 2001 19:29:40 +0400 From: egor duda X-Mailer: The Bat! (v1.53 RC/4) Reply-To: egor duda Organization: deo X-Priority: 3 (Normal) Message-ID: <13097881035.20010710192940@logos-m.ru> To: Corinna Vinschen Subject: Re: inetd security issues In-Reply-To: <20010710172216.S8578@cygbert.vinschen.de> References: <5.0.2.1.0.20010710214050.00ad6308@mail.sprintsoft.com> <20010710172216.S8578@cygbert.vinschen.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hi! Tuesday, 10 July, 2001 Corinna Vinschen cygwin@cygwin.com wrote: CV> Using Cygwin is not secure at all. If you or your admin has CV> honest security concerns don't open up the system by providing CV> services via inetd actually, i'm not aware of any _remotely_ exploitable holes in cygwin inetutils. do anybody? yes, cygwin process can be easily exploited locally, it's a known problem (or, rather a bunch of problems). But if someone finds a remotely exploitable hole in, say, ftpd, of sshd, it's equally drastic for cygwin and for any unix -- both on cygwin and unices those daemons usually run as root. Egor. mailto:deo@logos-m.ru ICQ 5165414 FidoNet 2:5020/496.19 -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Bug reporting: http://cygwin.com/bugs.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/