[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1354479884.3208.12.camel@scapa>
Date: Sun, 02 Dec 2012 21:24:44 +0100
From: Yves-Alexis Perez <corsac@...ian.org>
To: oss-security@...ts.openwall.com
Cc: Kurt Seifried <kseifried@...hat.com>, king cope
<isowarez.isowarez.isowarez@...glemail.com>,
full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
todd@...ketstormsecurity.org, submit@...sec.com, Mitre CVE assign
department <cve-assign@...re.org>, Steven Christey <coley@...re.org>,
security@...iadb.org, security@...ql.com, Ritwik Ghoshal
<ritwik.ghoshal@...cle.com>, moderators@...db.org
Subject: Re: Re: [Full-disclosure] MySQL (Linux) Stack based
buffer overrun PoC Zeroday
On dim., 2012-12-02 at 21:17 +0100, king cope wrote:
> My opinion is that the FILE to admin privilege elevation should be patched.
> What is the reason to have FILE and ADMIN privileges seperated when
> with this exploit
> FILE privileges equate to ALL ADMIN privileges.
Maybe because you might not want admins to have read/write access to the
filesystem anyway?
Regards,
--
Yves-Alexis
Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
