Bugtraq mailing list archives
Re: [TL-Security-Announce] Linux Kernel TLSA2000013-1
From: gshapiro () SENDMAIL ORG (Gregory Neil Shapiro)
Date: Wed, 28 Jun 2000 10:30:43 -0700
-----BEGIN PGP SIGNED MESSAGE----- rluethi> TurboLinux Security Announcement rluethi> Package: kernel-2.2.15 and earlier rluethi> Date: Monday June 19 17:45 PDT 2000 rluethi> TurboLinux Advisory ID#: TLSA2000013-1 rluethi> BugTraq ID#: 1322 rluethi> Credits: This vulnerability was discovered by Wojciech Purczynski. rluethi> 1. Problem Summary rluethi> Originally this security bug was reported by Sendmail. An unsafe rluethi> fgets() usage in sendmail's mail.local exposes the setuid() security rluethi> hole in the Linux kernel. This vunlnerability allows local users to rluethi> obtain root privilege by exploiting setuid root applications. This is completely incorrect. This problem had nothing to do with an unsafe fgets(). There are no unsafe fgets() in sendmail or mail.local. This was a bug in the Linux kernel, not in sendmail and not in mail.local. Please correct your advisory and post an updated version. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0 for non-commercial use Comment: Processed by Mailcrypt 3.5.5, an Emacs/PGP interface Charset: noconv iQCVAwUBOVo2OnxLZ22gDhVjAQE4FwQArXGXsv0vC29SOQiEfetkaC94ByJfDkG6 CW+Ovjv9nc3ThbbpK7UR/+1ffD8Uw2fMDb5+07mffZO2Bhw4n3dZ7eyXwbFvpCT6 j05eDyVgkLxBhrrxjVKIeeNDQJPP+joxvfc11DlZzt1J1EuhWeHF6SSEzYJAajaN 5os5ccgee80= =Y5Cs -----END PGP SIGNATURE-----
Current thread:
- Re: local root on linux 2.2.15, (continued)
- Re: local root on linux 2.2.15 Firstname Lastname (Jun 15)
- Re: local root on linux 2.2.15 Robert Watson (Jun 18)
- Net Tools PKI server exploits Jim Stickley (Jun 19)
- XFree86: libICE DoS Chris Evans (Jun 19)
- XFree86: Various nasty libX11 holes Chris Evans (Jun 19)
- XFree86: xdm flaw; present in kdm Chris Evans (Jun 19)
- XFree86: xdm xdmcp code in wdm also Brian Russo (Jun 20)
- Re: XFree86: xdm xdmcp code in wdm also Jerome ALET (Jun 20)
- Problems with "kon2" package Chris Evans (Jun 19)
- [TL-Security-Announce] Linux Kernel TLSA2000013-1 Roger Luethi (Jun 19)
- Re: [TL-Security-Announce] Linux Kernel TLSA2000013-1 Gregory Neil Shapiro (Jun 28)
- CERT Advisory CA-2000-12 Roman Drahtmueller (Jun 19)
- Re: local root on linux 2.2.15 Joseph Gooch (Jun 15)
- Conectiva Linux Security Announcement - ZOPE Sergio Bruder (Jun 16)