Re: ncurses 4.1 security bug

[perry () piermont com (Perry E. Metzger)]

Duncan Simpson writes:
> ncurses version 4.1 fails to drop priviledges before opening the
> termcap database and you can set any file(s) you like.

This is not a bug. ncurses is a *library*, not a *program*. It is up
to suid programs to drop privileges, not every call that invokes them --
or are you going to declare the fact that fopen() doesn't drop
privileges a "bug"?

.pm