Sendmail & procmail local root exploits on Linux kernel up to 2.2.16pre5

[wp () ELZABSOFT PL (Wojciech Purczynski)]

A few days ago while I was coding my kernel module I discovered a problem
with Linux capability model. My idea was to drop inheritable capability
set as non-root user and then execute some setuid-root program that would
be unable to drop its privileges.

I wrote two versions of proof-of-concept exploits. The day after, I
contacted linux and sendmail developers. They created patches that have
been available since yesterday. Procmail developers have been contacted,
as well, since procmail is also affected by this kernel bug.

Exploits are attached to this message.

-wp

+--------------------------------------------------------------------+
| Wojciech Purczynski   wp () elzabsoft pl  http://www.elzabsoft.pl/~wp |
| GSM: +48604432981   Linux Administrator   SMS: wp-sms () elzabsoft pl |
+------ Public GnuPG Key:  http://www.elzabsoft.pl/~wp/gpg.asc ------+

<HR NOSHADE>
<UL>
<LI>TEXT/PLAIN attachment: sendmail exploit
</UL>

<HR NOSHADE>
<UL>
<LI>TEXT/PLAIN attachment: sendmail & procmail exploit
</UL>