[1238] in linux-security and linux-alert archive
Re: [linux-security] Security hole in installation of suidperl from RedHat 4.0
daemon@ATHENA.MIT.EDU (Andrzej K. Brandt)
Sat Oct 19 06:37:33 1996
From: andy@melkor.mimuw.edu.pl (Andrzej K. Brandt)
In-Reply-To: <Pine.BSF.3.91.961018153954.7826B-100000@mail.kolej.mff.cuni.cz> from Leos Bitto at "Oct 18, 96 03:53:09 pm"
To: andy@melkor.mimuw.edu.pl (Andrzej K. Brandt)
Date: Sat, 19 Oct 1996 10:06:52 +0100 (MET)
Leos Bitto wrote:
> I've found security hole in installation of suidperl from RedHat 4.0. After
> installation it has suid bit AND sgid bit set. It needs only suid bit.
> When you leave sgid bit on, it will allow anybody to gain access to group
> 0 (root). So do immediatelly "chmod g-s /usr/bin/suidperl" as root, if
> you have RedHat 4.0 installed.
I've just installed RedHat 4.0 for Sparc - and suidperl hasn't sgid set.
--
/-------------------+--------+-------------------+-------------------------\
I Andrzej K. Brandt I SP5WCA I andy@mimuw.edu.pl I andy@linux.org.pl I
+-------------------+--------+-----+-------------+-------------------------+
| http://melkor.mimuw.edu.pl/~andy | IRC: Emin | PGP key available |
\--------------------------------------------------------------------------/
