Date: Thu, 09 Jan 1997 16:35:14 +0100 From: Eivind Eklund <eivind@dimaga.com> To: Pierre.Beyssac@hsc.fr (Pierre Beyssac) Cc: security@freebsd.org Subject: Re: sendmail running non-root SUCCESS! Message-ID: <3.0.32.19970109163513.009da930@dimaga.com>
next in thread | raw e-mail | index | archive | help
At 03:35 PM 1/9/97 +0100, Pierre Beyssac wrote: >Rather, something sendmail would call by giving it a program name >and a user id to run it as. > >For example, supposing a ~user/.forward is > >\user, "| /home/user/bin/myownstuff" > >sendmail could process the .forward as usual, but it would >call the external prog mailer to ask it to run "/home/user/bin/myownstuff" >as "user" and pipe the mail to it. > >Obviously it has to be more complicated than that or it would >be a trivial new hole in the system (we can't rely on just checking >that sendmail is calling us, that would not make us immune to attacks >on sendmail itself). There is a trivial solution. Just make 'progmail' parse .forward too (could be compiled from the same source), and just take a user-id (and mail on stdin). No holes that I can see. Eivind Eklund / perhaps@yes.no / http://maybe.yes.no/perhaps/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3.0.32.19970109163513.009da930>