From owner-freebsd-security Tue Feb 5 1:20:57 2002 Delivered-To: freebsd-security@freebsd.org Received: from gilberto.physik.RWTH-Aachen.DE (gilberto.physik.RWTH-Aachen.DE [137.226.46.168]) by hub.freebsd.org (Postfix) with ESMTP id C341637B400 for ; Tue, 5 Feb 2002 01:20:54 -0800 (PST) Received: (from kuku@localhost) by gilberto.physik.RWTH-Aachen.DE (8.11.6/8.11.6) id g159KrP55937 for freebsd-security@freebsd.org; Tue, 5 Feb 2002 10:20:53 +0100 (CET) (envelope-from kuku) Date: Tue, 5 Feb 2002 10:20:53 +0100 (CET) From: Christoph Kukulies Message-Id: <200202050920.g159KrP55937@gilberto.physik.RWTH-Aachen.DE> To: freebsd-security@freebsd.org Subject: .forward+ group writable directory Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Since two days my procmail filter isn't working anymore and I see these logs in my maillog. It's FreeBSD 4.4 with ESMTP Sendmail 8.11.6/8.11.6 (the stock that comes withthe distribution). Is it likely that I have been hacked? I see otherwise no signs thereof. Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward.host+: Group writable directory Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward+: Group writable directory Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward.host: Group writable directory Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward: Group writable directory -- Chris Christoph P. U. Kukulies kuku@gil.physik.rwth-aachen.de To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message