Full Disclosure mailing list archives
Re: Compaq mount patch broken
From: Weimer () CERT Uni-Stuttgart DE (Florian Weimer)
Date: Tue, 03 Sep 2002 20:44:47 +0200
psz () maths usyd edu au (Paul Szabo) writes:
I have reported this to Compaq (but expect no speedy resolution). I am puzzled: why patch /sbin/mount or /usr/bin/csh if they are not setuid?
Paul confirmed in private email that /sbin/mount is statically linked. I guess that it contains a copy of the RPC code for NFS mounts. xdr_array() is actually used for interaction with rpc.mountd, so a new /sbin/mount binary was needed to remove a potential threat. (I haven't got access to a Tru64 system, so this is pure, albeit plausible speculation.) -- Florian Weimer Weimer () CERT Uni-Stuttgart DE University of Stuttgart http://CERT.Uni-Stuttgart.DE/people/fw/ RUS-CERT fax +49-711-685-5898
Current thread:
- Compaq mount patch broken Paul Szabo (Sep 02)
- Re: Compaq mount patch broken Florian Weimer (Sep 03)
- <Possible follow-ups>
- Re: Compaq mount patch broken Paul Szabo (Sep 03)