Subject: linux svgalib: potential security hole
From: [email-masked]
Date: Thu, 14 Apr 1994 22:10:50 GMT
Newsgroups: comp.os.linux.announce

If you have a "convfont" executable on your system, and it's installed
setuid, de-setuid it.

"convfont" is a utility that comes with svgalib. The svgalib
installation will install it setuid, most likely setuid root, by
default. This permits anybody to write any file on the system, which
is sufficient to break in as root.

There's nothing inherently wrong with the program, it just should not
be setuid.

Please propagate this message to any other Linux admins you know,
especially those who won't see this. I don't know whether any of the
major out-of-the-box distributions are affected; I'd expect not. 

-- 
   - David A. Holland          | "The right to be heard does not automatically
     [email-masked] |  include the right to be taken seriously."
--
Mail submissions for comp.os.linux.announce to: [email-masked]
Be sure to include Keywords: and a short description of your software.