Newsgroups: comp.os.linux.announce
From: kkaplan@cdfas1.in2p3.fr (Kim-Minh Kaplan)
Subject: Security hole if man-2.0a2 installed setuid
Message-ID: <ann-2022.770433265@cs.cornell.edu>
Date: Wed, 1 Jun 1994 01:14:45 GMT
Approved: linux-announce@tc.cornell.edu (Matt Welsh)

  There's a security hole in man-2.0a2 if the program is installed
setuid (and typing `make install' does that). Users can gain damemon's
rights, and probabily root's as well. I sent a patch to correct this
to the autor. In the mean time I recommand that you do:

	# chmod 755 /usr/bin/man

  Note: I think that this problem exists in all previous versions of
this man package. So event if you use an old one you should not setuid
it!

---
kkaplan@cdfas1.in2p3.fr
Kim-Minh KAPLAN, 2 square des Mimosas, 75013 Paris -- France.
--

---
kkaplan@cdfas1.in2p3.fr
Kim-Minh KAPLAN, 2 square des Mimosas, 75013 Paris -- France.

--
Mail submissions for comp.os.linux.announce to: linux-announce@tc.cornell.edu
Be sure to include Keywords: and a short description of your software.
