[13558] in bugtraq
Re: majordomo 1.94.5 does not fix all vulnerabilities
daemon@ATHENA.MIT.EDU (Dave Barr)
Tue Jan 25 15:14:57 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <388DB92F.F5D0D137@visi.com>
Date: Tue, 25 Jan 2000 08:54:39 -0600
Reply-To: Dave Barr <barr@VISI.COM>
From: Dave Barr <barr@VISI.COM>
X-To: BUGTRAQ@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
Brock Sides wrote:
> Whereas majordomo 1.94.5 does fix the bug in resend, discovered by Brock
> Tellier, that permits execution of arbitrary code as user majordomo, it
> apparently does not fix the other bug in the script majordomo, that
> permits execution of arbitrary config files as user majordomo:
While people need to certainly be made clear of this, this is entirely
intentional.
The cleanest fix to the problem of the majordomo programs running
arbitrary code as the majordomo user/group is to fix the permissions
of the wrapper so it is mode o-rx. (or that the Majordomo home
directory is mode mode 750) Any other proposed solutions were
fraught with race conditions, partial fixes, and just plain uglinesses.
This is clearly explained in the INSTALL document in 1.94.5 and
re-emphasized on the Majordomo FAQ.
--Dave
Majordomo FAQ maintainer
