Subject: [SECURITY ALERT] Big hole in libc 4.5.26
From: Dominik Kubla <[email-masked]>
Date: Fri, 9 Sep 1994 18:13:26 GMT
Newsgroups: comp.os.linux.announce

WARNING! There is a HUGE hole in the NIS part of libc 4.5.26:

If a ypbind process is running the getpwent function simply ignores
all /etc/passwd entries and queries the NIS server all the time,
even if you haven't put a + entry in your passwd file.
This is not the way it should be done.

My advice is to either disable NIS or insure (via /etc/yp.conf) that
only trusted servers are queried. Especially the ypset feature
should be disabled...

Dominik Kubla
---------------------------------------------------------------------------
eMail: [email-masked]    sMail: Dominik Kubla, Lannerstrasse 53
                                            55270 Ober-Olm, F.R. of Germany
>>> Save the environment NOW! <<<           ******  European  Union  ******

--
Send submissions for comp.os.linux.announce to: [email-masked]
Be sure to include Keywords: and a short description of your software.