Path: utzoo!utgpu!watmath!looking!brad
From: brad@looking.UUCP (Brad Templeton)
Newsgroups: news.sysadmin
Subject: Re: Possible Fines for Virus Perpetrator
Keywords: Morris, virus, internet
Message-ID: <2279@looking.UUCP>
Date: 8 Nov 88 07:28:35 GMT
References: <456@l5comp.UUCP> <12081@dscatl.UUCP> <16600@agate.BERKELEY.EDU>
Reply-To: brad@looking.UUCP (Brad Templeton)
Distribution: na
Organization: Looking Glass Software Ltd.
Lines: 23

This is why I said the virus was a good thing.  If this bug had simply
been reported, what would have taken place?

 o Attempts would be made to make sure the information was never broadcast.

 o People would try to send the fix out to various sysadmins, half of whom
   would not fix it because they're lazy, and 1/4 of whom would not fix it
   because sysadmins are the only ones to know about it.

 o The fix would go in the next release, and after a few years, most people
   will have upgraded, except perhaps their server machines which run just
   fine and don't need the extensive work of an upgrade.

Now everybody has worked to plug it, and plug it fast.

To those who corrected me about this bug allowing root access:  You are
right, most sites do not run sendmail as root.  But remember the principle
that a corrupted system program is a corrupted system.  (Particularly
a mail program.)   How many systems make absolutely sure that system programs
owned by the sendmail owner *never* get executed by root, or the root-only
cron, etc.
-- 
Brad Templeton, Looking Glass Software Ltd.  --  Waterloo, Ontario 519/884-7473