Subject: Security hole in Xdos
From: [email-masked] (John D. Smith)
Date: Mon, 18 Apr 1994 16:38:31 GMT
Newsgroups: comp.os.linux.announce

There is a serious security hole in the current release of Xdos
(xdos03f). The various titchy shell-scripts which are provided (xd.*)
all invoke the main program xdos, but in the distribution version
(xdos03f.tar.gz) xdos is setuid root. Thus anyone using Xdos can
potentially read *and write* any file on the system, including
/etc/passwd. This is a Bad Thing: if you are using Xdos, change the
permissions on the executable file xdos to make it non-setuid.
--

--
John Smith             Dr J. D. Smith, Faculty of Oriental Studies,
[email-masked]    Sidgwick Avenue, Cambridge CB3 9DA
                       Tel. 0223 335140   Fax 0223 335110

--
Mail submissions for comp.os.linux.announce to: [email-masked]
Be sure to include Keywords: and a short description of your software.
-- 
Linux: Generous programmers from around the world all join forces to help
       you shoot yourself in the foot for free.