[8040] in bugtraq
Re: About rpc.* programs and SIGUSR1 signal...
daemon@ATHENA.MIT.EDU (Chris Frey)
Sat Sep 26 22:48:44 1998
Date: Sat, 26 Sep 1998 12:21:40 -0400
Reply-To: Chris Frey <cdfrey@foursquare.net>
From: Chris Frey <cdfrey@FOURSQUARE.NET>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: <360B714B.14B9@mygale.org>
On Fri, 25 Sep 1998, ga wrote:
> Finally, this reminded me of an old DoS that I found long time ago but I
> never
> released it (sorry if it is already known). This was based on the same
> USR1
> signal. When sendmail receives a SIGUSR1 signal, it dumps some infos in
> the
> /var/log/debug file. As sendmail is suid then it runs with root
[snip]
> I tried this on sendmail 8.8.0 (as I told you above, it has been a
> longtime).
I checked my copies of sendmail-8.8.6 and sendmail-8.9.1 that I had
available and it looks to me like it uses syslog to do the state dump on a
SIGUSR1.
I don't have 8.8.0 to check with, but perhaps syslog was setup to write
LOG_DEBUGs to /var/log/debug?
- Chris
