From owner-freebsd-security Sun Nov 24 19:27:19 1996 Return-Path: owner-security Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id TAA00621 for security-outgoing; Sun, 24 Nov 1996 19:27:19 -0800 (PST) Received: from scanner.worldgate.com (scanner.worldgate.com [198.161.84.3]) by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id TAA00612 for ; Sun, 24 Nov 1996 19:27:14 -0800 (PST) Received: from alive.ampr.ab.ca (uucp@localhost) by scanner.worldgate.com (8.7.5/8.7.3) with UUCP id UAA27223 for security@freebsd.org; Sun, 24 Nov 1996 20:27:06 -0700 (MST) Received: from localhost (marcs@localhost) by alive.ampr.ab.ca (8.7.5/8.7.3) with SMTP id UAA15005 for ; Sun, 24 Nov 1996 20:27:00 -0700 (MST) Date: Sun, 24 Nov 1996 20:27:00 -0700 (MST) From: Marc Slemko Reply-To: Marc Slemko To: security@freebsd.org Subject: cvs commit: ports/x11/XFree86 Makefile (fwd) Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-security@freebsd.org X-Loop: FreeBSD.org Precedence: bulk As per the below commit, SuperProbe is no longer setuid root on FreeBSD. I would highly recommend that you remove the setuid bit if it is installed on your system; it is normally in /usr/X11R6/bin/SuperProbe if you have X installed. 'chmod u-s /usr/X11R6/bin/SuperProbe' will do the trick. There are at least two possible buffer overflows which are trivial to find by looking through the source. I have not investigated them fully to determine if they are exploitable; they are not exploitable using the more common methods, but they could still be exploitable. By removing the setuid bit, the net result is that non-root users can't probe your video chip. Funny, but to me that is a good thing not a bad thing. ---------- Forwarded message ---------- Date: Sun, 24 Nov 1996 18:29:27 -0800 (PST) From: Jean-Marc Zucconi To: CVS-committers@freefall.freebsd.org, cvs-all@freefall.freebsd.org, cvs-ports@freefall.freebsd.org Subject: cvs commit: ports/x11/XFree86 Makefile jmz 96/11/24 18:29:27 Modified: x11/XFree86 Makefile Log: Remove the suid bit of SuperProbe. According to Marc Slemko (marcs@alive.ampr.ab.ca) there are potential security holes in SuperProbe and it is not going to be setuid in the next release. Revision Changes Path 1.23 +2 -1 ports/x11/XFree86/Makefile