Newsgroups: comp.os.linux.announce
From: jds10@cus.cam.ac.uk (John D. Smith)
Subject: Security hole in Xdos
Message-ID: <ann-28405.766687094@cs.cornell.edu>
Date: Mon, 18 Apr 1994 16:38:31 GMT
Approved: linux-announce@tc.cornell.edu (Matt Welsh)

There is a serious security hole in the current release of Xdos
(xdos03f). The various titchy shell-scripts which are provided (xd.*)
all invoke the main program xdos, but in the distribution version
(xdos03f.tar.gz) xdos is setuid root. Thus anyone using Xdos can
potentially read *and write* any file on the system, including
/etc/passwd. This is a Bad Thing: if you are using Xdos, change the
permissions on the executable file xdos to make it non-setuid.
--

--
John Smith             Dr J. D. Smith, Faculty of Oriental Studies,
jds10@cus.cam.ac.uk    Sidgwick Avenue, Cambridge CB3 9DA
                       Tel. 0223 335140   Fax 0223 335110

--
Mail submissions for comp.os.linux.announce to: linux-announce@tc.cornell.edu
Be sure to include Keywords: and a short description of your software.
-- 
Linux: Generous programmers from around the world all join forces to help
       you shoot yourself in the foot for free.

