Re: (PM) Feature Request (was SECURITY PROBLEM.)

John Gonzalez/netMDC admin (ekool@ns1.netmdc.com)
Thu, 9 Jul 1998 10:51:24 -0600 (MDT)

On Thu, 9 Jul 1998, Rick Smith wrote:

|| >From what I gather, nothing will be done about the telnet bug ? I can't
|| believe people at lucent don't think it's important. For a company that's
|| so security minded, too.
||
|| It's too bad this little "feature" will pop up on rootshell.com someday,
|| since they LOVE finding backdoors into ISP's anyway they can get them.
||
|| You can say to your employees, "reset console before you quit!" till
|| you're blue in the face, but there are times it just doesn't happen. what
|| about WHILE THEY'RE DEBUGGING ? It's vulnerable then.
||
|| sure... "run comos3.8 or greater and use the Java app" is the response
|| from livingston, so they don't have to add 2 lines of code that will
|| "bloat" the server, but what about when ComOS releases SUCK so bad we
|| refuse to use them at all ?
||
|| Just have to vent. Livingston/Lucent starts to aggravate me more and more
|| everyday with stupid little shit like this.

Okay, i want to add my 2 cents. 1.) Livingston should fix the problem.
That goes without saying, it is a potential security risk, the question
is, how far on the scale up is it? This is a user/hardware problem,
meaning, that IF you do your job right, you will not have to worry about
it. Sure, your telnet session may close, and you may not be able to set
debug off, but if that happens, telnet in and close the session. How hard
is that? This would be like saying "YOU HAVE TO MAKE UNIX LOG ROOT OFF IF
I LEAVE THE CONSOLE!!!!" You should be responsible for logging root off,
and making sure that it is done properly. Not the unix vendors. Try and
take a little responsibility for your actions in the future.

John Gonzalez
MDC Computers/netMDC! Internet Services
(505) 437-7600 / http://www.netmdc.com
[---------------------------------------------[system info]------------]
10:05am up 82 days, 21:56, 1 user, load average: 0.02, 0.03, 0.00

-
To unsubscribe, email 'majordomo@livingston.com' with
'unsubscribe portmaster-users' in the body of the message.
Searchable list archive: <URL:http://www.livingston.com/Tech/archive/>