[11739] in bugtraq
Re: Root shell vixie cron exploit
daemon@ATHENA.MIT.EDU (Valentin Nechayev)
Wed Sep 8 09:54:04 1999
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Message-Id: <19990904105150.A26218@lucky.net>
Date: Sat, 4 Sep 1999 10:51:50 +0300
Reply-To: netch@lucky.net
From: Valentin Nechayev <netch@LUCKY.NET>
X-To: Seva Gluschenko <gvs@RINET.RU>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <Pine.BSF.4.10.9909012102410.31140-100000@diggy.rinet.ru>; from
Seva Gluschenko on Wed, Sep 01, 1999 at 09:08:55PM +0400
Hello Seva Gluschenko!
Wed, Sep 01, 1999 at 21:08:55, gvs wrote about "Re: Root shell vixie cron exploit":
MZ> flags, this exploit won't bring anything shocking - simply, it's working
MZ> example.
>
> man sendmail:
> /-C
> ...skipping...
> -Cfile Use alternate configuration file. Sendmail refuses to run
> as root if an alternate configuration file is specified.
>
> and it does, for sure %-).
>
> Just tested this on different versions of FreeBSD and had no effects
> except Mail Delivery message:
>
> The following address has permanent fatal errors:
> -C/tmp/vixie-cf gvs
>
> So, sendmail _really_ refuses to accept -C key when run as root
Try to run sendmail with -C option as _root_ and you can really change
config file when were root. -C flag only disable suid:root (causing setting
effective uid to real uid via drop_privileges()). We really use sendmail
with alternative configuration files in technology.
Therefore, MZ is right...
--
Valentin Nechayev
netch@lucky.net
II:LDXIII/DCCCLXXIII.CCC
