Re: Fwd: Multiple vendor 'Taylor UUCP' problems.

[ Available lists | Index of freebsd-security | Month of Sep 2001 | Week of 8 Sep 2001 | Raw email | View thread | Wrap long lines | Reply | Tag ]
From
Todd C. Miller <Todd.Miller@courtesan.com>
Date
8 Sep 2001 18:21:48
Subject
Re: Fwd: Multiple vendor 'Taylor UUCP' problems.
Message-ID
200109090120.f891KvM14677@xerxes.courtesan.com


[ Hide this part ]
In message <20010908180848.A94567@xor.obsecurity.org>
so spake Kris Kennaway (kris):

> The vulnerability involves uucp being made to run arbitrary commands
> as the uucp user through specifying a custom configuration file - see
> bugtraq. There may be other problems resulting from user-specified
> configuration files. I don't have time to go through the code and fix
> up the revocation of privileges right now..in the meantime, this
> prevents the root exploit where a user replaces a uucp-owned binary
> like uustat, which is called daily by /etc/periodic.

Is there really any reason to run uustat as root? Why not just run
it as user uucp via su? For that matter, running non-root owned
executables from daily seems like a really bad idea.

- todd

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message



Elapsed time: 0.249 seconds