[14406] in bugtraq
Re: gpm-root
daemon@ATHENA.MIT.EDU (Alessandro Rubini)
Fri Mar 24 03:30:21 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Message-Id: <20000323214054.A11053@morgana.systemy.it>
Date: Thu, 23 Mar 2000 21:40:54 +0100
Reply-To: Alessandro Rubini <rubini@LINUX.IT>
From: Alessandro Rubini <rubini@LINUX.IT>
X-To: egmont@FAZEKAS.HU
To: BUGTRAQ@SECURITYFOCUS.COM
Hello Egmont.
> I've sent report about the following security hole to the
> authors of gpm, but they seemed to ignore the problem.
That's me, mainly. Unfortunately, I don't have any track of your
message about gpm-root.
> gpm-root is a beautiful tool shipped in the gpm package.
Not really that beautiful. It was just meant to be a demo, in the hope
someone will develop a real root-window tool. Anyways, it's
distributed, so I care(d) about its bugs.
> gpm-root calls setuid() first and setgid() afterwards, hence
> the later one is unsuccessful. The authors completely forgot
> about calling initgroups().
Thanks for your report, I'll fix it for 1.19.1, which I plan to
release in a few days. Since gpm is officially unmaintained,
gpm-1.19.1 will be the last one, hopefully, but I already had
it on schedule.
I want to thank Servio Medina for forwarding your message, as I
unsubscribed from bugtraq not long ago, due to excessive email load.
/alessandro
