getting vendors to fix security bugs

[Root Boy Jim]

In article <1991Feb20.004811.28521 at convex.com> tchrist at convex.COM (Tom Christiansen) writes:
>From the keyboard of rbj at uunet.UU.NET (Root Boy Jim):
>:The mknod bug has been fixed....
>
>Speaking of which I wonder when they'll get around to fixing or disabling
>suid scripts.  Anybody have the very latest release of SunOS and able to
>verify whether the bug's still there?

Isn't perl supposed to figure this out and
complain if it hasn't been disabled?

Don't y'all have any Suns? :-)

BTW, what are the chances of hitting the window on the suid scripts?
By that I mean, suppose I have the perfect program to exploit it,
which I've just compiled on a system where a suid script and the
perfect conditions to exploit it exist. Isn't it true that
(1) I have only a very small chance of winning, and
(2) I only get one shot?

Has anyone done any real measurements?  Has anyone actually
successfully exploited this bug (of course I mean under test
conditions, on your own machine, where you have root access anyway),
or do we all just parrot this mantra: suid scripts are insecure.
-- 
		[rbj at uunet 1] stty sane
		unknown mode: sane