Bugtraq mailing list archives

vixiecron.


From: cor () hacktic nl (Cor Bosman)
Date: Fri, 5 Aug 1994 11:57:58 +0200


One of the bugs I found and reported to Vixie about a year ago regarding
his vixiecron, was that you could do the following:

MAILTO="whatever; /bin/cp /bin/sh /tmp; chmod 4777 /tmp/sh"

He fixed this, and with it introduced a new bug we also reported.
I can't really remember the details, but it had something to do with
a temporary file he was using, that you could predict, and thus link
to /etc/master.passwd or something.

Cor



Current thread: