[18509] in bugtraq
Re: Solaris /usr/lib/exrecover buffer overflow
daemon@ATHENA.MIT.EDU (Darren J Moffat)
Tue Jan 9 20:20:45 2001
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <3A5BA1B2.59C2570E@Eng.Sun.COM>
Date: Tue, 9 Jan 2001 15:41:38 -0800
Reply-To: Darren.Moffat@ENG.SUN.COM
From: Darren J Moffat <Darren.Moffat@ENG.SUN.COM>
X-To: Pablo Sor <psor@AFIP.GOV.AR>
To: BUGTRAQ@SECURITYFOCUS.COM
Pablo Sor wrote:
> The /usr/lib/exrecover contains a buffer overflow
> (this command is suid in Solaris 2.4/5/6)
Starting with Solaris 7 exrecover is no longer installed setuid root.
It is safe to change the exrecover permissions to 0555 on all other
releases since it doesn't need elevated privleges to do its job;
/var/preserve is 1777.
This is Sun bug# 4161925
--
Darren J Moffat
