Re: [cobalt-users] Will a future Code Red Version ever effect Linux????

["Dylan Smith" <dyls@xxxxxxx>]

> I was just wondering if a future version of code red could ever effect a
Linux system?
>
> Is Linux open to such buffer overflow attacks?

You can never say never (Linux, and indeed all Unixes were vulnerable to the
BIND buffer overflow exploit if BIND was running as a root user).

The main problem with Code Red and IIS is that IIS runs effectively as the
NT equivalent of "root", therefore anything exploiting the hole that Code
Red does gains root access to the NT system.

You can give yourself some pre-emptive resistance to things like this by not
running any daemons as root that don't have to be run as root (therefore, if
a future hole is found, the exploit is limited to the privileges the dameon
runs with).
Apache already executes stuff as user "nobody" (and runs as user httpd, not
root). On my system, I have BIND (named) running as non-root also. If you
have a RaQ2, you have some additional security through obscurity because you
aren't using the ubiquitous Intel x86, so you are binary incompatible with
most of the skript kiddies exploit scripts.

But there is no such thing as absolute security - you must be vigilant.