Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (athena.apache.org: domain of tomcatgeek@gmail.com
 designates 209.85.223.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <F0DA8C0D-74C8-498B-BF1D-A07E684429EE@cornell.edu>
References: <9BFD8A9280D5F741802A3BA05AFFD8705E0537@INFPWXM006.ad.unsw.edu.au>
	<51824E15.2040302@ptc.com>
	<5182512A.5000000@apache.org>
	<5182A22E.8010509@christopherschultz.net>
	<F0DA8C0D-74C8-498B-BF1D-A07E684429EE@cornell.edu>
Date: Tue, 7 May 2013 15:13:34 +0530
Message-ID: 
 <CANjPuzXr2USpDueEcRxO+8dC=gHX8dE7aXCC57Z730f7YH+Wgw@mail.gmail.com>
Subject: Re: Attacks in Apache servers
From: M Eashwar <tomcatgeek@gmail.com>
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: multipart/alternative; boundary=20cf30223cb39b0a3a04dc1da68f

--20cf30223cb39b0a3a04dc1da68f
Content-Type: text/plain; charset=ISO-8859-1

Hi All,

    Thanks for your views.

    It seems to be like very difficult to come for a conclusion :-)

Regards
Eashwar


On Thu, May 2, 2013 at 11:08 PM, David N. Smith <david.smith@cornell.edu>wrote:

> >
> > Didn't you know that 'rm' was vulnerable on Linux?!?!
> >
> > An attacker with escalated privileges can -- through clever use of
> > this misunderstood command with code so complicated, that this
> > enormous vulnerability went unnoticed for decades -- wreak havoc on
> > any Linux system connected to the iterwebs. The only plausible
> > mitigation of this egregious vulnerability is to uninstall the 'rm'
> > package or switch to a more secure OS.
> >
>
> I think the vulnerability is limited to versions that support the options
> -r and -f.  ;-)
>
> -- David
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>

--20cf30223cb39b0a3a04dc1da68f--