Vulnerability Development mailing list archives
Re: UUCP
From: sirsyko () ishiboo com
Date: Fri, 30 Nov 2001 15:17:27 -0800
On Fri, Nov 30, 2001 at 08:48:17AM -0500, Bob Howard wrote:
Izik wrote:Hello i've found buffer overflow in uucp. in BSDi platform...since uucp is by nature suid. and the ownership is by uucp i don't see the real profit.Don't know about BSDi, but on Solaris uucp owns tip, uuencode, uudecode, and others. So if I can use this vuln to su uucp, I can trojan e.g. tip. Then the next time root runs what he thinks is tip, I've got the box.
on solaris: $ grep uucp /etc/inetd.conf uucp stream tcp nowait root /usr/sbin/in.uucpd in.uucpd $ ls -ld /usr/sbin/in.uucpd -r-xr-xr-x 1 uucp 9940 Jul 16 1997 /usr/sbin/in.uucpd dunno if its the default, but it worked for me in 1995, and some boxes still have this set up. Adam