Richard Pieri wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
>
> >>>>> "DL" == Daniel Lark <dan@netsteps.com> writes:
>
> DL> For those who might not know, CERT has just issued an advisory on
> DL> Perl 4.x through 5.002.
>
> Specifically, suidperl, the perl interpreter which attempt to fake out
> the kernel to allow set-UID scripts. Since Majordomo uses a C wrapper
> program, it is secure in this regard. Compiled programs do not generate
> the race condition that can result from set-UID scripts.
>
The problem with suidperl can give anyone root access very easily...
Thus, even though it's not directly a MD problem, it can be if some-
one uses it to munge up your system <g>
--
Jim Jagielski << jim@jaguNET.com >> | "That's a Smith & Wesson,
** jaguNET Access Services ** | and you've had your six"
Email: info@jaguNET.com | - James Bond
++ http://www.jaguNET.com/ +++ Voice/Fax: 410-931-3157 ++
References:
|
|
