Bugtraq mailing list archives
Re: Troff dangerous.
From: thorpej () NAS NASA GOV (Jason Thorpe)
Date: Sun, 25 Jul 1999 13:27:44 -0700
On Sun, 25 Jul 1999 17:29:56 +0600 CyberPsychotic <mlists () GIZMO KYRNET KG> wrote:
~ If you want your system safe, ~ don't look as root ~ at manual page. ~ with accurately set permissions for man page directories, non-privileged users shouldn't be able to add manual pages to the system (if they are able to, system is whacked anyway), so I take this threat merely as another trojan possibility - quite uncommon one indeed.
The trick is that it can get you if you as a system administrator download some open source program from the Internet, and build and install that program; such activity often happens as "root", so a couple of scenarios are possible: (1) Root installs the malicious roff source unknowingly. (2) During the process of building/installing the program, groff is invoked as root to create a pre-formatted version of the manual page (a "cat page"), at which point the trojan horse does it dirty work. -- Jason R. Thorpe <thorpej () nas nasa gov>
Current thread:
- Re: Troff dangerous. John Robert LoVerso (Jul 25)
- Re: Troff dangerous. Nic Bellamy (Jul 25)
- Re: Troff dangerous. Aaron Campbell (Jul 26)
- Re: Troff dangerous. Olaf Kirch (Jul 26)
- <Possible follow-ups>
- Re: Troff dangerous. Joel Eriksson (Jul 25)
- Re: Troff dangerous. Pete (Jul 25)
- Re: Troff dangerous. Robert Watson (Jul 27)
- Re: Troff dangerous. Yozo Toda (Jul 25)
- Re: Troff dangerous. Eric Moore (Jul 25)
- Re: Troff dangerous. Ville Nummela (Jul 27)
- Re: Troff dangerous. Pete (Jul 25)
- Re: Troff dangerous. Jason Thorpe (Jul 25)
- Retrieving RDS Data... Wanderley J. Abreu Jr (Jul 26)
- Re: Troff dangerous. Bob Beck (Jul 26)
- Re: Troff dangerous. Ronny Cook (Jul 25)
- Re: Troff dangerous. Steven M. Bellovin (Jul 26)
- Re: Troff dangerous. Groovy Pants Gus (Jul 26)
- Re: Troff dangerous. Nic Bellamy (Jul 25)