Re: Solaris mailx hole

[casper () holland Sun COM (Casper Dik)]

> It's a very very old hole in /bin/mail that allows race conditions in
> which .rhosts files can be created...
>
> I would have thought this was fixed by 2.5, but it wasn't. My boss just a
> few minutes ago exploited it on a sol2.5 machine.


Very interesting.

In Solaris 2.5,

        /usr/bin/mail is set-gid mail, not set-uid root
        /usr/bin/mailx is set-gid mail, not set-uid root
        /usr/lib/sendmail doesn't use /bin/mail for the delivery of
        mail, it uses /usr/lib/mail.local


If there's a problem I really want to get it fixed, but considering that
mail delivery uses an entirely different program in Solaris 2.5, I find
it hard to believe that the 8lgm exploit still works.

Even in Solaris 2.3 with patches all I get is bounced mail with:

mail: '/var/mail/root' must be regular or character special file with no links

or no output at all.

(this is with /bin/mail patch 101574-04 but the readme doesn't list any
security fixes)


Casper