Newsgroups: comp.os.linux.announce
Subject: linux svgalib: potential security hole
Message-ID: <ann-25470.766361425@cs.cornell.edu>
From: dholland@husc.harvard.edu
Date: Thu, 14 Apr 1994 22:10:50 GMT
Approved: linux-announce@tc.cornell.edu (Matt Welsh)

If you have a "convfont" executable on your system, and it's installed
setuid, de-setuid it.

"convfont" is a utility that comes with svgalib. The svgalib
installation will install it setuid, most likely setuid root, by
default. This permits anybody to write any file on the system, which
is sufficient to break in as root.

There's nothing inherently wrong with the program, it just should not
be setuid.

Please propagate this message to any other Linux admins you know,
especially those who won't see this. I don't know whether any of the
major out-of-the-box distributions are affected; I'd expect not. 

-- 
   - David A. Holland          | "The right to be heard does not automatically
     dholland@husc.harvard.edu |  include the right to be taken seriously."
--
Mail submissions for comp.os.linux.announce to: linux-announce@tc.cornell.edu
Be sure to include Keywords: and a short description of your software.
