From: Wilf <G.Wilford@ee.surrey.ac.uk>
Newsgroups: comp.os.linux.announce
Subject: Security problems with manual pagers.
Date: 17 Jul 1994 21:41:54 GMT
Approved: linux-announce@tc.cornell.edu (Lars Wirzenius)
Message-ID: <30c8j2$d74@hydra.Helsinki.FI>

It has become apparant that all manual pagers based on J. W. Eaton's man-1.0
have inherent security problems when installed setuid.

Any normal user can gain the effective uid of man with very little effort.

This problem is known to occur with man versions 1.0, 1.1, 1.1B, 1.2, 1.3
and 2.0a2.

If you have one of these versions I recommend either:

a) reinstalling it non-setuid.
b) installing it setuid 'something_that_nothig_else_is'
c) installing man_db-2.1b1

Version 1.4b, has not been tested by myself, but it's documentation warns of
installing it setuid, thus it may still have the security holes.

(a) will allow any user to hack about with anything in a cat directory and
is not recommended. (b) is maybe worse as it may give you the impression
that your cat directories are safe, or may expose further security holes in
your version. (c) is advised for all who do not rely on compressed man
source and are not in need of NLS support as this version does not yet
support these.

This is not an advertisement for man_db-2.1b1 nor is it a claim that it is
absolutely secure. What I can claim though, is that all of the setuid part
has been recoded and all user interruptible external programs than man
executes are now done with no effective priveledges enabled. 

Cheers,
Wilf. (maintainer of man_db-2.1b1)
--
	Dept. of Electronic Eng.	"Even a stopped clock gives the	
	University of Surrey		    right time twice a day." 
	Guildford			      - I (Withnail & I)
	England.			email: g.wilford@ee.surrey.ac.uk


--
Mail submissions for comp.os.linux.announce to: linux-announce@tc.cornell.edu
PLEASE remember Keywords: and a short description of the software.
