Re: majordomo local exploit

To: BUGTRAQ@xxxxxxxxxxxxxxxxx
Subject: Re: majordomo local exploit
From: John Archie <johnarchie@xxxxxxxxxxxxxxxxxx>
Date: Sat, 1 Jan 2000 23:45:20 -0500
Approved-by: aleph1@SECURITYFOCUS.COM
Delivered-to: bugtraq@lists.securityfocus.com
Reply-to: John Archie <johnarchie@xxxxxxxxxxxxxxxxxx>
Sender: Bugtraq List <BUGTRAQ@xxxxxxxxxxxxxxxxx>

I chgrp'ed the wrapper to mail (the user that sendmail demotes itself to in
order to run the wrapper on my system) and do not allow normal users to
execute the wrapper.  Majordomo works fine after the change, but this breaks
anything that feeds input into the majordomo scripts directly that doesn't
have permission to execute the wrapper.

--John

Prev by Date: Re: strace can lie
Next by Date: HPUX Aserver revisited.
Previous by thread: Re: strace can lie
Next by thread: Re: majordomo local exploit
Index(es):
- Date
- Thread