From: Mete Balci (mete@karga.eelab.itu.edu.tr)
Date: Thu 15 Jun 2000 - 16:12:11 EEST
Merhaba,
Omer Faruk Bey mesajin aslinin faydali olabilecegini yazdi. Genelde
securityfocus 'tan geliyor bu e-mail ler. Yeni duyanlarin uye olmasini
tavsiye ederim. IT 'de sistem admin. olarak calisan bircok kisi bile bu
tur listeleri takip etmiyor. Kesinlikle izlenilmesi gerekir diye
dusunuyorum.
Iyi calismalar,
Mete BALCI
ITU
---------- Forwarded message ----------
Date: Fri, 9 Jun 2000 08:59:36 +0200
From: Wojciech Purczynski <wp@ELZABSOFT.PL>
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Sendmail & procmail local root exploits on Linux kernel up to
2.2.16pre5
A few days ago while I was coding my kernel module I discovered a problem
with Linux capability model. My idea was to drop inheritable capability
set as non-root user and then execute some setuid-root program that would
be unable to drop its privileges.
I wrote two versions of proof-of-concept exploits. The day after, I
contacted linux and sendmail developers. They created patches that have
been available since yesterday. Procmail developers have been contacted,
as well, since procmail is also affected by this kernel bug.
Exploits are attached to this message.
-wp
+--------------------------------------------------------------------+
| Wojciech Purczynski wp@elzabsoft.pl http://www.elzabsoft.pl/~wp |
| GSM: +48604432981 Linux Administrator SMS: wp-sms@elzabsoft.pl |
+------ Public GnuPG Key: http://www.elzabsoft.pl/~wp/gpg.asc ------+
Listeden cikmak icin:
unsub linux
mesajini listeci@bilkent.edu.tr adresine gonderiniz.
Lutfen Listeci icin MIME / HTML / Turkce Aksan kullanmayin.
Listeci arayuzu: http://listweb.bilkent.edu.tr/yardim/bilkent/linux.html
Liste arsivinin adresi: http://listweb.bilkent.edu.tr/