Re: Add murmur.

[pelzflorian (Florian Pelz)]

On 02/12/2017 06:01 PM, Hartmut Goebel wrote:
> Am 12.02.2017 um 15:37 schrieb David Craven:
>> I think that it is a minor
>> issue at best, since anything that isn't accessible over the network or 
>> running
>> with any sort of privileges is not very useful.
> 
> I strongly disagree!
> 
> Every piece of software available on the system may the intruder. The
> server may not be running so it can not be attacked in the first place.
> But if an intruder gains (unprivileged) access to the system, he might
> be able to start that server software. Then he might use it for
> privilege escalation (if the server software is vulnerable), as a
> back-channel or for attacking further systems.
> 

An attacker with enough privileges to run Murmur has enough privileges
to install Murmur anyway (perhaps but not necessarily by using Guix). Do
I misunderstand?

Regards,
Florian