Bugtraq mailing list archives

Re: majordomo local exploit

From: huuskone () CC HELSINKI FI (Taneli Huuskonen)
Date: Wed, 29 Dec 1999 17:30:15 +0200


-----BEGIN PGP SIGNED MESSAGE-----

"Todd C. Miller" <Todd.Miller () COURTESAN COM> wrote:

For those using perl 5.x, you can use sysopen() instead of the "magic"
perl open() to fix this.


I'm afraid that wouldn't help much, as you can supply any pathname as
the -C (configuration file) argument:

        /path/to/majordomo/wrapper resend -l foobar -C /tmp/evilhack.pl

I tested this with version 1.94.1, but the same behaviour seems to be
there in 1.94.4, as far as I can tell by the source.

Taneli Huuskonen

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQB1AwUBOGoorAUw3ir1nvhZAQF31gL9HRxD8LOVsilgTuj5iRRTHdhI0cGS7AF/
cBzVkofDCcu4UamxZj7weOqK//EbHPjEuFE7ABW4sb4CHXigA0rVuc/B2QKntX7A
UmceOIjDSU8iVj5FqFkbo9u3uysC8ngl
=Iy7+
-----END PGP SIGNATURE-----

--
I don't   | All messages will be PGP signed,  | Fight for your right to
speak for | encrypted mail preferred.  Keys:  | use sealed envelopes.
the Uni.  | http://www.helsinki.fi/~huuskone/ | http://www.gilc.org/

Current thread:

Remote DoS/Access Attack in Internet Anywhere Mail Server(POP 3) v2.3.1, (continued)
- Remote DoS/Access Attack in Internet Anywhere Mail Server(POP 3) v2.3.1 Steven Alexander (Dec 27)
- Trend Micro InterScan VirusWall SMTP bug asl () USA ALCATEL COM (Dec 27)
- L0pht Advisory: initscripts-4.48-1 RedHat Linux 6.1 Mudge (Dec 27)
- UnixWare local pis exploit Brock Tellier (Dec 27)
- Third Party Software Affected by IIS "Escape Character Parsing" V ulnerability Microsoft Product Security Response Team (Dec 28)
- majordomo local exploit Brock Tellier (Dec 28)
  - $cf Security flaw Shevek (Dec 02)
  - Re: majordomo local exploit Christopher Schulte (Dec 28)
  - Re: majordomo local exploit Todd C. Miller (Dec 28)
    - AltaVista rudi carell (Dec 29)
    - Re: majordomo local exploit Taneli Huuskonen (Dec 29)
    - Re: majordomo local exploit Coolio (Dec 29)
    - Re: majordomo local exploit Henrik Edlund (Dec 29)
    - bna,sh Loneguard (Dec 30)
    - Re: majordomo local exploit Andrew Brown (Dec 30)
    - Re: majordomo local exploit Henrik Nordstrom (Dec 30)
    - Fix for HP-UX automountd/autofs exploit (fwd) Doug Siebert (Dec 30)
    - Re: Fix for HP-UX automountd/autofs exploit (fwd) LaMont Jones (Dec 31)
    - vibackup.sh Loneguard (Dec 31)
    - More info on MS99-061 (IIS escape character vulnerability) .rain.forest.puppy. (Dec 29)
    - Follow UP AltaVista rudi carell (Dec 30)

(Thread continues...)