[prev in list] [next in list] [prev in thread] [next in thread] 

List:       freebsd-security
Subject:    Re: FrontPage Server Extensions
From:       Marc Slemko <marcs () znep ! com>
Date:       1998-10-23 15:00:00
[Download RAW message or body]

On Fri, 23 Oct 1998, Alan B. Clegg wrote:

>  [.. snippage ..]
> 
> > Regardless, I certainly am not overly willing to put much trust in
> > programs written by the same people that wrote the horrible monstrosity
> > that the original fpexe.c was.
> 
> And you run sendmail perhaps?
> 
> Just because a previous version was bad does not PROVE that the newer ones
> are still bad.

Erm... it doesn't prove they are bad (and I never said or implied that it
did), but it sure as heck is a pretty damn big black mark against thiking
that they are good.

Here are the facts:

If there is any hole in the FrontPage CGI scripts, then someone can
compromise any account that is setup to use it.

The fpexe program, which did have source available, was obviously written
by someone who had absolutely no concept of or thought for security.

I don't have the source for the FrontPage CGI scripts, but they come in
the same package as the fpexe monstrosity.

Therefore, you have to work on the assumption that the FrontPage CGI
scripts probably have numerous security holes in them.

Regardless of what you may think, people and companies don't magically
change overnight from producing code without a "security clue" in the
world to producing secure code.  If you don't think past problems matter
then go right ahead and do whatever you want.  I, however, do think that
past problems matter a heck of a lot, especially in this situation due to
the nature of the problems.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

[prev in list] [next in list] [prev in thread] [next in thread]