Subject: Re: Security hole in smail - be careful!
From: [email-masked] (Christopher Oliver)
Date: Fri, 7 Oct 1994 18:29:05 GMT
Newsgroups: comp.os.linux.misc,comp.mail.smail,comp.os.linux.announce

-----BEGIN PGP SIGNED MESSAGE-----

Martin Bartosch ([email-masked]) wrote:
> Hi,

> last night I discovered a potential danger to all sites that run smail.
> A quick check on some other sites (thanks to the folks on #linux)
> revealed that most systems are affected by this.

> Essentially, the smail bug will allow ordinary users to create files
> anywhere they want to:

  I confirmed this bug both under linux and Solaris 2.3.  This bug allows
a user to append data to an arbitrary file.

  I have written a source patch to remove this bug.  I have sent the
diff to the the original authors as well.  I have removed the method of
exploition which was included in the original post, but I suggested that
the author should write CERT.  The patch follows:

*** main.c.orig Fri Oct  7 04:31:28 1994
- --- main.c      Fri Oct  7 04:05:32 1994
***************
*** 333,338 ****
- --- 333,339 ----
      }

      if (config_file != save_config_file || arg_second_config_file ||
+         arg_debug_file ||
        arg_director_file || arg_router_file || arg_transport_file ||
        arg_qualify_file || arg_retry_file || arg_smail_lib_dir ||
        arg_alias_file || operation_mode == REBUILD_ALIASES)

To obtain my key, either finger [email-masked] or use a
key server such as pgp.ai.mit.edu.

-- 
Christopher Oliver                              Computer Science Office
Concurrent Computations Research Center  __o    Friedmann Hall
Internet: [email-masked]          _`\<,_   Western Michigan University
                                      (_)/ (_)  Kalamazoo, Michigan, 49008-5021

--
Send submissions for comp.os.linux.announce to: [email-masked]
Be sure to include Keywords: and a short description of your software.