Subject: Security hole if man-2.0a2 installed setuid
From: [email-masked] (Kim-Minh Kaplan)
Date: Wed, 1 Jun 1994 01:14:45 GMT
Newsgroups: comp.os.linux.announce

There's a security hole in man-2.0a2 if the program is installed
setuid (and typing `make install' does that). Users can gain damemon's
rights, and probabily root's as well. I sent a patch to correct this
to the autor. In the mean time I recommand that you do:

	# chmod 755 /usr/bin/man

  Note: I think that this problem exists in all previous versions of
this man package. So event if you use an old one you should not setuid
it!

---
[email-masked]
Kim-Minh KAPLAN, 2 square des Mimosas, 75013 Paris -- France.
--

---
[email-masked]
Kim-Minh KAPLAN, 2 square des Mimosas, 75013 Paris -- France.

--
Mail submissions for comp.os.linux.announce to: [email-masked]
Be sure to include Keywords: and a short description of your software.