Date: Wed, 10 Jul 2002 20:56:04 +0400 From: "Artem 'Zazoobr' Ignatjev" <timon@netherworld.ru> To: FreeBSD-gnats-submit@FreeBSD.org, freebsd-bugs@FreeBSD.org Subject: Re: .12.3 and `msgs' alias Message-ID: <20020710205604.A5518@netherworld.ru> In-Reply-To: <200206281220.g5SCK1QC022319@freefall.freebsd.org>; from FreeBSD-gnats-submit@FreeBSD.org on Fri, Jun 28, 2002 at 05:20:01AM -0700 References: <200206281208.g5SC81CR049970@netherworld.ru> <200206281220.g5SCK1QC022319@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--BOKacYhQ+x31HxR3
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Fri, Jun 28, 2002 at 05:20:01AM -0700, FreeBSD-gnats-submit@FreeBSD.org =
wrote:
> Thank you very much for your problem report.
> It has the internal identification `misc/39951'.
> The individual assigned to look at your
> report is: freebsd-bugs.=20
>=20
> >Category: misc
> >Responsible: freebsd-bugs
> >Synopsis: Sendmail 8.12.3 and `msgs' alias
> >Arrival-Date: Fri Jun 28 05:20:01 PDT 2002
More digging lead me to following hack (msgs will now be suid, so if it
can be exploited, that'll be one more hole):
---- Begin patch ----
diff -U 3 -r usr.bin/msgs/Makefile usr.bin/msgs/Makefile
--- usr.bin/msgs/Makefile Wed Jul 10 20:44:12 2002
+++ usr.bin/msgs/Makefile Wed Jul 10 20:41:08 2002
@@ -4,5 +4,6 @@
PROG=3D msgs
DPADD=3D ${LIBTERMCAP}
LDADD=3D -ltermcap
+BINMODE=3D 4755
=20
.include <bsd.prog.mk>
diff -U 3 -r usr.bin/msgs/msgs.c usr.bin/msgs/msgs.c
--- usr.bin/msgs/msgs.c Wed Jul 10 20:40:12 2002
+++ usr.bin/msgs/msgs.c Wed Jul 10 20:41:21 2002
@@ -179,7 +179,7 @@
setlocale(LC_ALL, "");
=20
time(&t);
- setuid(uid =3D getuid());
+ setuid(uid =3D geteuid());
ruptible =3D (signal(SIGINT, SIG_IGN) =3D=3D SIG_DFL);
if (ruptible)
signal(SIGINT, SIG_DFL);
---- End patch ----
Directions: apply this standing in source tree root (shake well before
using :-) )
Sinceherely yours, Artem 'Zazoobr' Ignatjev.
--- Unix is like a wigwam: No windows, no gates and an apache inside.
--BOKacYhQ+x31HxR3
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org
iD8DBQE9LGcjgvMkrc2+hzYRApnaAKCtYKfvpCpxyZYRH/FLCepgON+OlQCghtvi
Hy5p8Lsoc+nasx4N2s48MXI=
=lZAc
-----END PGP SIGNATURE-----
--BOKacYhQ+x31HxR3--
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020710205604.A5518>