> there is no egg* to overflow and break a chroot. Thus, if you don't
> put CHROOT/bin/sh in place, the standard attacks will fail, but a
> smart attacker can still get in. In practicality, there are few smart
> attackers.
>
It only takes *one* smart attacker with a subscription to Bugtraq and a
predeliction to share his or her work. The l0pht (which you referanced) is
a perfect example of this.
/****************************************************************************
Alfred Huger http://www.secnet.com/ballista
Project Director ahuger @
secnet .
com
Secure Networks Inc. (SNI)
*****************************************************************************/
Follow-Ups:
References:
|
|
