[16256] in bugtraq
Trustix security advisory - apache-ssl
daemon@ATHENA.MIT.EDU (Oystein Viggen)
Tue Aug 15 16:40:18 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Message-Id: <03og2uhjx8.fsf@colargol.tihlde.hist.no>
Date: Tue, 15 Aug 2000 12:56:35 +0200
Reply-To: Oystein Viggen <oysteivi@TRUSTIX.COM>
From: Oystein Viggen <oysteivi@TRUSTIX.COM>
X-To: tsl-announce@trustix.com
To: BUGTRAQ@SECURITYFOCUS.COM
Hi
Due to a typo in the rpm spec file for apache-ssl, /usr/sbin/httpsd on a
Trustix system will be installed with mode 756 instead of 755, making a
binary file that will be run by root world writable. It should not be
necessary to explain why this is an extremely bad thing.
How this bug slipped through our testing I can not explain, but it is
easily removed by doing "chmod 755 /usr/sbin/httpsd". A new rpm package
has been made availible on our ftp site.
i586 RPM:
ftp://ftp.trustix.com/pub/Trustix/updates/1.1/RPMS/apache-ssl-1.3.12_1.39-7tr.i586.rpm
SRPM:
ftp://ftp.trustix.com/pub/Trustix/updates/1.1/SRPMS/apache-ssl-1.3.12_1.39-7tr.src.rpm
I'll go stand in a corner with a brown paperbag over my head now...
Humbly,
Oystein
--
TSL developer
