[15532] in bugtraq
Re: [TL-Security-Announce] Linux Kernel TLSA2000013-1
daemon@ATHENA.MIT.EDU (Gregory Neil Shapiro)
Wed Jun 28 18:56:36 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <14682.13891.653453.639206@horsey.gshapiro.net>
Date: Wed, 28 Jun 2000 10:30:43 -0700
Reply-To: Gregory Neil Shapiro <gshapiro@SENDMAIL.ORG>
From: Gregory Neil Shapiro <gshapiro@SENDMAIL.ORG>
X-To: tl-security-announce@www1.turbolinux.com
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <20000619180557.A4599@turbolinux.com>
-----BEGIN PGP SIGNED MESSAGE-----
rluethi> TurboLinux Security Announcement
rluethi> Package: kernel-2.2.15 and earlier
rluethi> Date: Monday June 19 17:45 PDT 2000
rluethi> TurboLinux Advisory ID#: TLSA2000013-1
rluethi> BugTraq ID#: 1322
rluethi> Credits: This vulnerability was discovered by Wojciech Purczynski.
rluethi> 1. Problem Summary
rluethi> Originally this security bug was reported by Sendmail. An unsafe
rluethi> fgets() usage in sendmail's mail.local exposes the setuid() security
rluethi> hole in the Linux kernel. This vunlnerability allows local users to
rluethi> obtain root privilege by exploiting setuid root applications.
This is completely incorrect. This problem had nothing to do with an
unsafe fgets(). There are no unsafe fgets() in sendmail or mail.local.
This was a bug in the Linux kernel, not in sendmail and not in mail.local.
Please correct your advisory and post an updated version.
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.0 for non-commercial use
Comment: Processed by Mailcrypt 3.5.5, an Emacs/PGP interface
Charset: noconv
iQCVAwUBOVo2OnxLZ22gDhVjAQE4FwQArXGXsv0vC29SOQiEfetkaC94ByJfDkG6
CW+Ovjv9nc3ThbbpK7UR/+1ffD8Uw2fMDb5+07mffZO2Bhw4n3dZ7eyXwbFvpCT6
j05eDyVgkLxBhrrxjVKIeeNDQJPP+joxvfc11DlZzt1J1EuhWeHF6SSEzYJAajaN
5os5ccgee80=
=Y5Cs
-----END PGP SIGNATURE-----
