Re: /usr/bin/Mail exploit for Slackware 7.0 (mail-slack.c)

[drow () FALSE ORG (Daniel Jacobowitz)]

On Sun, Jun 04, 2000 at 10:59:13AM -0700, Daniel Jacobowitz wrote:
> Well, it does generate a shell on Debian/woody, but Mail has already
> dropped priviledges:
>
> drow@quaketop:~% ./mail
> type '.' and enter: .
> Cc: too long to edit
> sh-2.04$ id
> uid=1000(drow) gid=1000(drow) groups=1000(drow)
>
> Same back to Debian/slink.

After a discussion with Paulo, I've figured out why that was happening;
this does indeed affect Debian.  There will be a security upload
momentarily.

Dan

/--------------------------------\  /--------------------------------\
|       Daniel Jacobowitz        |__|        SCS Class of 2002       |
|   Debian GNU/Linux Developer    __    Carnegie Mellon University   |
|         dan () debian org         |  |       dmj+ () andrew cmu edu      |
\--------------------------------/  \--------------------------------/