Re: Gaping security hole? (network db connections)

Anders Hackin' Karlsson <anders.karlsson@karlsson.pp.se> wrote: > I'm not getting in to this discussion if .rhosts/hosts.equiv is bad > or not. I'll just comment on a factoid. As you state that anyone can > play with the PC hostaddresses, connecting from a DOS/WIN/NT PC to > Informix is different than connecting from a UNIX box. Last time I check > the code this was very clear (which was a long time ago, 3 years or so) > it was there, and if you test it, you'll see I'm right. This was > introduced in OnLine 5 something I think. > When connecting from a PC, the password is always validated using > getpwent() or whatever the system call is, I forgot it and I'm too lazy > to look it up. > Now, if your end users are on PC's running SCO or UnixWare of > whatever, then things are different. No, this is individual users logging into a unix workstation that now (because of this hole) have FULL access to the database server that isn't restricted by userid. > Rgds > Karlsson > BTW. I didn't read all your communication (it was a lot) so this point > might have already been made. In that case, I apologize... > Michael Segel wrote: > [snip snip] > > > > -Mikey > > > > -- > > #include <std_disclaimer.h> /* Mike Segel (MS385) */ > > #include <No_Spam.h> > > #ifdef OFFENDED_BY_CONTENT > > The author takes no responsibility for this post. > > Any resemblence to a coherent rational thought is purely coincidence. > > -The Management. > > #endif > > ***************************** > > Due to AGIS's Refusal to Act Responsibly > > We are blocking all of their domains at the packet level. > > This block will exist until AGIS modifies their policies to > > conform to existing RFCs and net community standards. > > > > We encourage all ISPs and domain holders to do the same. > > ***************************** > -- > ==================================================================== > Anders Hackin' Karlsson > Your friendly Database Guru > Email: andersk.karlsson@karlsson.pp.se > "Every time I've built character, I've regretted it" Calvin > ==================================================================== -- ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216