[4221] in bugtraq
symlink bug in tin/rtin
daemon@ATHENA.MIT.EDU (NetRunner)
Sat Mar 29 13:01:06 1997
Date: Sat, 29 Mar 1997 17:45:24 +0100
Reply-To: NetRunner <nr@C64.ORG>
From: NetRunner <nr@C64.ORG>
To: BUGTRAQ@NETSPACE.ORG
Small bug I discovered in the unix NEWS reader tin/rin.
Then a user run rtin/tin a user-list will be created in /tmp/.tin_log
with mode 0666. and if a user makes a symlink from /etc/passwd (or any
file) to /tmp/.tin_log and root or another user with uid 0 runs rtin/tin,
tin will follow the symlink to /etc/passwd and change the mode to 0666.
I hope no admin's are stupid enough to run rtin/tin as uid 0. :-)
/NetRunner
nr@c64.org
