Bugtraq mailing list archives

Re: symlink bug in tin/rtin


From: nelson () PANGEIA COM BR (Nelson Murilo)
Date: Sat, 29 Mar 1997 15:29:21 -0300


On Sat, 29 Mar 1997, NetRunner wrote:

}Small bug I discovered in the unix NEWS reader tin/rin.
}
}Then a user run rtin/tin a user-list will be created in /tmp/.tin_log
}with mode 0666. and if a user makes a symlink from /etc/passwd (or any
}file) to /tmp/.tin_log and root or another user with uid 0 runs rtin/tin,
}tin will follow the symlink to /etc/passwd and change the mode to 0666.
}
}I hope no admin's are stupid enough to run rtin/tin as uid 0. :-)

This is old problem, to fix add or change this line in Makefile:
COPTS = -c -O -DDONT_LOG_USER
and recompile rtin/tin package.

}/NetRunner
}nr () c64 org

Regards,

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
N e l s o n  M u r i l o
Pangeia Informatica - Provedor de solucoes Internet.
http://www.pangeia.com.br
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .



Current thread: