Mailing-List: contact cygwin-help AT sourceware DOT cygnus DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT sources DOT redhat DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT sources DOT redhat DOT com>
List-Help: <mailto:cygwin-help AT sources DOT redhat DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT sources DOT redhat DOT com
Delivered-To: mailing list cygwin AT sources DOT redhat DOT com
Date: Tue, 10 Jul 2001 19:29:40 +0400
From: egor duda <deo AT logos-m DOT ru>
X-Mailer: The Bat! (v1.53 RC/4)
Reply-To: egor duda <cygwin AT cygwin DOT com>
Organization: deo
X-Priority: 3 (Normal)
Message-ID: <13097881035.20010710192940@logos-m.ru>
To: Corinna Vinschen <cygwin AT cygwin DOT com>
Subject: Re: inetd security issues
In-Reply-To: <20010710172216.S8578@cygbert.vinschen.de>
References: <5 DOT 0 DOT 2 DOT 1 DOT 0 DOT 20010710214050 DOT 00ad6308 AT mail DOT sprintsoft DOT com>
 <20010710172216 DOT S8578 AT cygbert DOT vinschen DOT de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi!

Tuesday, 10 July, 2001 Corinna Vinschen cygwin AT cygwin DOT com wrote:

CV> Using Cygwin is not secure at all. If you or your admin has
CV> honest security concerns don't open up the system by providing
CV> services via inetd

actually, i'm not aware of any _remotely_ exploitable holes in cygwin
inetutils. do anybody?

yes, cygwin process can be easily exploited locally, it's a known
problem (or, rather a bunch of problems). But if someone finds a
remotely exploitable hole in, say, ftpd, of sshd, it's equally drastic
for cygwin and for any unix -- both on cygwin and unices those daemons
usually run as root.

Egor.            mailto:deo AT logos-m DOT ru ICQ 5165414 FidoNet 2:5020/496.19


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/