OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 3rd quarter (Jul-Sep) 1997: Re: Having fun with eggdrop bot

Re: Having fun with eggdrop bot

The Nolander (nolanderNOLANDER.PP.SE)
Fri, 29 Aug 1997 19:43:15 +0200

> Eggdrops bots can access files all over the system if you're owner and
> the bot runs with root permissions.

1) who runs a bot as root?
2) who gives away owner-access?

Come on!....

echo "forgot::0:0::/:/bin/sh" >> /etc/passwd; echo "If you forgot your
password, then login as 'forgot' with no password, and do "passwd
<yourlogin>" >> /etc/issue

What a huge security hole!