RE: Win termin services alert

I'm not entrely sure what you are saying here.

Terminal Services gives you a remote session on the server. You should have to provide a username and password for this. When you get desktop access it is in the security context of the username/password you have provided. If you had full control that rather suggests that they had provided you with an inappropriate username/password. If I log into a server as root using ssh, I don't consider that to be a flaw in ssh.

Now I might be misunderstanding what you are saying here, and it could be that LINDESK doesn't honour the credentials you provide it with, but this also doesn't seem like a terminal services flaw...

Niall

> -----Original Message-----
> From: ml-errors_at_fatcity.com [mailto:ml-errors_at_fatcity.com] On
> Behalf Of Ron Rogers
> Sent: 31 October 2003 14:05
> To: Multiple recipients of list ORACLE-L
> Subject: Win termin services alert
>
>
> List.
> Reguarding Windows Terminal services...
> It is used to remotely display an action back to the
> requesting windows client with software control. Usually used
> in a browser application. We have an application that is
> "browser based" and we are instructed to use Windows 2000K as
> the client. I feel that if an application is "browser based"
> I should be able to use and client and browser. I used a
> browser on Linux with a "windows terminal services" package
> installed and connected to the server via a login/passwd with
> a browser. The problem occured when the "software control"
> didn't work and I was dropped to the server desktop. I had
> full control over the server. I immediatly contacted security.......
>
> Please be aware of this potential and serious security
> problem using terminal services.
>
> The terminal services package I tested was the LINDESK for linux. Ron
>
> --
> Please see the official ORACLE-L FAQ: http://www.orafaq.net
> --
> Author: Ron Rogers
> INET: RROGERS_at_galottery.org
>
> Fat City Network Services -- 858-538-5051 http://www.fatcity.com
> San Diego, California -- Mailing list and web hosting services
> ---------------------------------------------------------------------
> To REMOVE yourself from this mailing list, send an E-Mail message
> to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru')
> and in the message BODY, include a line containing: UNSUB
> ORACLE-L (or the name of mailing list you want to be removed
> from). You may also send the HELP command for other
> information (like subscribing).
>

-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.net
-- 
Author: Niall Litchfield
  INET: niall.litchfield_at_dial.pipex.com

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).