Re: Exploit for Linux wu.ftpd hole

[medulla () infosoc com (Mike Edulla)]

On Thu, 6 Jul 1995, Michael Shields wrote:

> Date: Thu, 6 Jul 1995 23:33:54 +0000
> From: Michael Shields <shields () tembel org>
> To: Multiple recipients of list BUGTRAQ <BUGTRAQ () CRIMELAB COM>
> Subject: Re: Exploit for Linux wu.ftpd hole
>
> > minicom has a known, but not very well-known hole in it that is nearly
> > identical to the wu-ftp hole. If you are a legitimate user of a pre 1.71
> > version of minicom, you can get root,
>
> What is minicom doing as root?  It should be setgid dialout.
>
> Is Slackware really doing that?

According to the minicom docs, minicom is designed to be suid root, and
won't work otherwise, and thats how its installed. You're right though,
it should be sgid UUCP or whatever...

But...The bug has been fixed, although third party suid root programs are
always suspicious.

> When you move something on top of messages, messages is unlinked.
> The file is still open, but no longer accessible through the directory
> structure.

Can this not be detected? Obviously the write will fail, when this occurs
- should not syslogd reopen (or attempt to reopen) the messages file, and
make a note of the problem as a debug warning? Or is there something that
makes this impossible/impractical.