[15973] in bugtraq
Group-writable executable in OpenLDAP
daemon@ATHENA.MIT.EDU (Christian Kleinewaechter)
Wed Jul 26 15:58:42 2000
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-ID: <Pine.LNX.4.10.10007261256390.29813-100000@hal01.Mathematik.Uni-Bielefeld.DE>
Date: Wed, 26 Jul 2000 13:33:23 +0200
Reply-To: Christian Kleinewaechter <kleinew@MATHEMATIK.UNI-BIELEFELD.DE>
From: Christian Kleinewaechter <kleinew@MATHEMATIK.UNI-BIELEFELD.DE>
To: BUGTRAQ@SECURITYFOCUS.COM
OpenLDAP installs the ud binary in $binpath with mode 775 and default
group (i.e. either you primary gid or the directories gid). Of course the
consequences depend on which group this actually is. This was checked with
1.2.11 (latest stable), but probably also exists in earlier versions,
since the Makefile.in is dated 1/14/1999. Developers have been notified
and fixed this issue (at least in the CVS tree). So either change the mode
in line
$(LTINSTALL) $(INSTALLFLAGS) -m 775 ud $(bindir)
to
$(LTINSTALL) $(INSTALLFLAGS) -m 755 ud $(bindir)
in clients/ud/Makefile.in (resp. clients/ud/Makefile if you don't use
autoconf) or chmod the executable afterwards (or maybe do nothing at all
if "default group" is a trusted group).
---------------------------------------------------------------------------
Dr. Christian Kleinewaechter
Universitaet Bielefeld
---------------------------------------------------------------------------
Wieviel Prozent hat ein Bit?
