Newsgroups: comp.os.linux.announce
From: Dominik Kubla <kubla@goofy.zdv.Uni-Mainz.de>
Subject: [SECURITY ALERT] Big hole in libc 4.5.26
Message-ID: <ann-13962.779134388@cs.cornell.edu>
Date: Fri, 9 Sep 1994 18:13:26 GMT
Approved: linux-announce@tc.cornell.edu (Matt Welsh)

WARNING! There is a HUGE hole in the NIS part of libc 4.5.26:

If a ypbind process is running the getpwent function simply ignores
all /etc/passwd entries and queries the NIS server all the time,
even if you haven't put a + entry in your passwd file.
This is not the way it should be done.

My advice is to either disable NIS or insure (via /etc/yp.conf) that
only trusted servers are queried. Especially the ypset feature
should be disabled...

Dominik Kubla
---------------------------------------------------------------------------
eMail: Dominik.Kubla@Uni-Mainz.DE    sMail: Dominik Kubla, Lannerstrasse 53
                                            55270 Ober-Olm, F.R. of Germany
>>> Save the environment NOW! <<<           ******  European  Union  ******

--
Send submissions for comp.os.linux.announce to: linux-announce@tc.cornell.edu
Be sure to include Keywords: and a short description of your software.
