[23356] in bugtraq
Re: UUCP
daemon@ATHENA.MIT.EDU (sirsyko@ishiboo.com)
Sat Dec 1 13:05:25 2001
Date: Fri, 30 Nov 2001 15:17:27 -0800
From: sirsyko@ishiboo.com
To: Bob Howard <reh@umich.edu>
Cc: Izik <izik@tty64.org>, vuln-dev@security-focus.com,
bugtraq@securityfocus.com
Message-ID: <20011130151727.A13019@skoda.sockpuppet.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
In-Reply-To: <3C078E21.258BA70A@umich.edu>
On Fri, Nov 30, 2001 at 08:48:17AM -0500, Bob Howard wrote:
> Izik wrote:
> >
> > Hello
> >
> > i've found buffer overflow in uucp. in BSDi platform
> ...
> > since uucp is by nature suid. and the ownership is by uucp
> > i don't see the real profit.
>
> Don't know about BSDi, but on Solaris uucp owns tip, uuencode, uudecode,
> and others. So if I can use this vuln to su uucp, I can trojan e.g.
> tip. Then the next time root runs what he thinks is tip, I've got the
> box.
on solaris:
$ grep uucp /etc/inetd.conf
uucp stream tcp nowait root /usr/sbin/in.uucpd in.uucpd
$ ls -ld /usr/sbin/in.uucpd
-r-xr-xr-x 1 uucp 9940 Jul 16 1997 /usr/sbin/in.uucpd
dunno if its the default, but it worked for me in 1995, and some boxes still
have this set up.
Adam
