|
Posted by all mail refused on July 4, 2004, 7:25 pm
If you were Registered and logged in, you could reply and use other advanced thread options
>Does there exist a security tool that can be used to scan the user
>home directories for presence of the versions of popular, freely
>distributed CGI or .php scripts that have well known security
>problems? Of course, if such tool could also look for the dangerous
>code in general that would be even better.
You'd have to decide what you call a security problem -
have you got an AUP for these users ?
It's fairly easy to scan CGIs for lack of tainting and use
of the
system([^,]+)
exec([^,]+)
and
open("$foo|"), open("|$foo")
constructions.
I like to constrain code where possible so that it can't
have unwanted results. (Consider SubDomain, systrace etc)
For instance I like webservers to accept TCP traffic on just
2 ports (80, 22) and cannot originate any TCP traffic at all.
That prevents spam relaying and the like without needing
to know the properties of the CGIs.
--
Elvis Notargiacomo master AT barefaced DOT cheek
http://www.notatla.org.uk/goen/
| 
XML site map