Bug#189659: will adopt dnrd
On Thu, Apr 24, 2003 at 10:30:06PM +1000, Anibal Monsalve Salazar wrote:
> SECURITY NOTE: dnrd is susceptible to buffer overflow attacks.
> However, by default dnrd changes to the "nobody" user. It also does
> a chroot to the /etc/dnrd directory, after checking that /etc/dnrd
> exists and contains no subdirectories and no executables and is only
> writable by root.
Using the nobody as a work around for possible security holes seems a
really bad idea.
At the very least, please consider using another user ID, as other
programs might be using the nobody user. If one program is compromised,
the rest will also become compromised if they are sharing the one user.
Also, even using a non-root, non-shared user id is not going to prevent
an attacker doing damage via a buggy daemon, non-root users can do bad
things too. eg. DOS attacks (ulimits should help here), attack computers
on private/firewalled networks, etc.
--
Brian May <bam@debian.org>
Reply to: