[cobalt-users] REMOVE SH

[netergy Training <cobaltlist@xxxxxxxxxxx>]

As I am sure most people will know, Sun posted a Security Hardening 
Patch. It is great in that it warns of port scans and buffer overflows.

Later they released a remove tool but said this was only because the 
SHP could cause the var directory to fill up with log files.

What they did not mention was that under certain circumstances a root 
exploit could happen.

What is more, a script has been publicised doing this.


From the script authors website:

5-12-2002 : I've decided that i'm not going to disclose any of
            my findings related to cobalt security research anymore.
            The main reason for this action are my negative thoughts
            about the way sun cobalt handles security issues.
            With this decision comes my last public cobalt exploit.

            Cobalt RaQ4 Remote root Exploit - raqrewt.c
            Affected : All Cobalt RaQ4 server appliances
            with the Security Harderning Package (SHP) installed.

The answer, remove SHP immediately. It is VERY dangerous to keep it. If 
you are a member of this list and you use a RaQ 4 to send mail, someone 
has probably already targeted you.

If anyone wants any further info, contact me off-list.