[1833] in Athena Bugs
nfprint: security issue
daemon@ATHENA.MIT.EDU (probe@ATHENA.MIT.EDU)
Tue Feb 28 08:24:47 1989
From: <probe@ATHENA.MIT.EDU>
Date: Tue, 28 Feb 89 08:24:36 EST
To: bugs@ATHENA.MIT.EDU
Reply-To: Richard Basch <probe@ATHENA.MIT.EDU>
"nfprint" executes "pr", but it searches for "pr" using your PATH
variable. This wouldn't be so bad if it executes "pr" as the user, but
instead, it executes it as "notes". This, of course, implies that "pr"
could be made to change access control lists.
-Richard
