From owner-freebsd-security  Tue Jun 25 02:39:15 1996
Return-Path: owner-security
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id CAA07877
          for security-outgoing; Tue, 25 Jun 1996 02:39:15 -0700 (PDT)
Received: from solar.tlk.com (root@solar.tlk.com [194.97.84.34])
          by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id CAA07871
          for <freebsd-security@freebsd.org>; Tue, 25 Jun 1996 02:39:04 -0700 (PDT)
Received: by solar.tlk.com 
	id <m0uYUaB-00022NC@solar.tlk.com>; Tue, 25 Jun 96 11:38 MET DST
Message-Id: <m0uYUaB-00022NC@solar.tlk.com>
From: torstenb@solar.tlk.com (Torsten Blum)
Subject: Re: I need help on this one - please help me track this guy down!
To: mwhite+@CMU.EDU (Matthew Jason White)
Date: Tue, 25 Jun 1996 11:38:51 +0200 (MET DST)
Cc: freebsd-security@freebsd.org
In-Reply-To: <0lnmnpy00YUp8Ea2EM@andrew.cmu.edu> from Matthew Jason White at "Jun 24, 96 08:04:05 pm"
Reply-To: torstenb@tlk.com
X-Mailer: ELM [version 2.4ME+ PL15 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-security@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

Matthew Jason White wrote:

> You probably want to change the security script so that it points out
> ALL suid programs in /usr/home, /tmp, /var/tmp and /usr/tmp, or any
> other publicly writeable area.  Are you running inn1.4 on this system? 
> If so, you should probably upgrade to inn-1.4uoff4 (this port should
> prolly be upgraded, if someone hasn't already).

inn runs as user `news', so you can never create a setuid root shell even
if inn has a bug...

 -tb