[1236] in linux-security and linux-alert archive
[linux-security] Security hole in installation of suidperl from RedHat 4.0
daemon@ATHENA.MIT.EDU (Leos Bitto)
Fri Oct 18 12:29:28 1996
Date: Fri, 18 Oct 1996 15:53:09 +0200 (MET DST)
From: Leos Bitto <bitto@kolej.mff.cuni.cz>
To: linux-security@tarsier.cv.nrao.edu
I've found security hole in installation of suidperl from RedHat 4.0. After
installation it has suid bit AND sgid bit set. It needs only suid bit.
When you leave sgid bit on, it will allow anybody to gain access to group
0 (root). So do immediatelly "chmod g-s /usr/bin/suidperl" as root, if
you have RedHat 4.0 installed.
Leos Bitto
<bitto@kolej.mff.cuni.cz>
