Bugtraq mailing list archives
[SECURITY] Seyon is vulnerable to a root exploit
From: joey () DEBIAN ORG (Martin Schulze)
Date: Sat, 29 Aug 1998 02:48:14 +0200
--5xSkJheCpeK0RUEJ Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Description ----------- We have received a report from SGI that a vulnerability has been discovered in the seyon program. This can lead to a root compromise. Any user who can execute the seyon program can exploit this vulnerability. Since SGI does not provide exploit information, we are unable to fix the problem. SGI provided such information only to recognized security response/incident/coordination organizations and bugtraq doesn't seem to be accepted. SGI doesn't develop patches to third party products, thus there is no chance for a quick fix. Vulnerability ------------- Since a root compromise needs an executable that runs as root we tend to belive that this needs a setuid seyon. The Seyon package as provided with Debian GNU/Linux does *not* run setuid root. Thus we doubt that the seyon package as provided with Debian GNU/Linux can be used to exploit root if you don't change the default behaviour. --=20 Never trust an operating system you don't have source for! --5xSkJheCpeK0RUEJ Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia iQCVAwUBNedPzhRNm5Suj3z1AQHEpwP+MYhSUKw6w+801H5WNJpptShGXCTmpUkE Ud7TdBIgdaiNQY7KSPvDxBjIE2y2cxJ66fmqr4283DkA/38WqULXEKyjCL0hv0eM 4rEA4LJtTGHUDwm1BRxiLhMra7s2BA/anguwGOKpHKtDdtkBmXUY5qrEXVwt9KU7 6GV5D3ASz+U= =Srhw -----END PGP SIGNATURE----- --5xSkJheCpeK0RUEJ--
Current thread:
- Re: Serious Security Hole in Hotmail, (continued)
- Re: Serious Security Hole in Hotmail Jeff Mcadams (Aug 25)
- Re: Serious Security Hole in Hotmail Jonathan A. Zdziarski - Systems Administrator (Aug 25)
- Webmail.bellsouth.net security problems Leonid S. Knyshov (Aug 25)
- Re: Webmail.bellsouth.net security problems Marc Slemko (Aug 25)
- Re: Webmail.bellsouth.net security problems Edward S. Marshall (Aug 25)
- Re: Webmail.bellsouth.net security problems Kragen (Aug 25)
- [paul () boehm org: [cert-advisory () cert org: CERT Summary CS-98.07]] Paul Boehm (Aug 26)
- [djb () redhat com: Unidentified subject!] Paul Boehm (Aug 26)
- SV: Serious Security Hole in Hotmail Jonathan James (Aug 26)
- Re: Webmail.bellsouth.net security problems Joe (Aug 28)
- [SECURITY] Seyon is vulnerable to a root exploit Martin Schulze (Aug 28)
- Update on Linux unfsd Olaf Kirch (Aug 29)
- Buffer overflows in Minicom 1.80.1 Eduardo Navarro (Aug 29)
- Re: Buffer overflows in Minicom 1.80.1 Alan Brown (Aug 29)
- Re: Buffer overflows in Minicom 1.80.1 M.C.Mar (Aug 31)
- Re: Buffer overflows in Minicom 1.80.1 Wichert Akkerman (Aug 31)
- buffer overflow in nslookup? Peter van Dijk (Aug 29)
- Re: buffer overflow in nslookup? Brandon Reynolds (Aug 29)
- Re: buffer overflow in nslookup? Peter van Dijk (Aug 30)
- FreeBSD's RST validation Tristan Horn (Aug 30)
- Re: FreeBSD's RST validation James Snow (Aug 30)
- Re: Serious Security Hole in Hotmail Jeff Mcadams (Aug 25)