Security bug in C news and INN

Article View: comp.security.misc

Article #1042

Back to comp.security.misc Previous Next

#1042

From: Tom Fitzgerald
Date: Thu, 10 Mar 1994 05:33

22 lines
1915 bytes

If we're all in a security-bug-reporting mood here....  The news bug
reported on the bugtraq mailing list definitely affects AIX and SCO Unix
systems running the performance release of C news, or versions of INN older
than December 1993.

With this bug, if a newgroup article is posted containing a line beginning
with ~!  the rest of the line will be executed in a shell, as the 'news'
user.  The article is mailed to the news admin by piping it into mail, and
SCO's and AIX's /bin/mail understands ~ escapes.  The article doesn't even
need to be processed; if something is wrong with it, like it's missing an
Approved: header, it'll still be mailed to the admin and triggered.

INN sites should upgrade to inn1.4sec.tar.Z from uunet or elsewhere, if
they haven't already.

C news sites can fix the problem by inserting a sed 's/^~/~~/' in a
pipeline in front of the calls to 'mail' in the scripts that do newgroup
and checkgroups processing.

-- 
Tom Fitzgerald   Wang Labs   Lowell MA, USA   1-508-967-5278   fitz@wang.com
Pardon me, I'm lost, can you direct me to the information superhighway?

Technical Details

Message-ID: <CMFosn.2A5@wang.com>

Path:

arc1-ca.pugleaf.net!gmd.de!newsserver.jvnc.net!yale.edu!yale!gumby!wupost!howland.reston.ans.net!europa.eng.gtefsd.com!ulowell!wang!fitz

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 115614,c920355aa2586820,start
X-Google-Attributes: gid115614,public
X-Google-Thread: 1122ea,c920355aa2586820,start
X-Google-Attributes: gid1122ea,public
X-Google-Thread: ff723,c920355aa2586820,start
X-Google-Attributes: gidff723,public
X-Google-ArrivalTime: 1994-03-09 21:33:58 PST
Newsgroups: comp.security.misc,biz.sco.general,comp.unix.aix
Path: arc1-ca.pugleaf.net!gmd.de!newsserver.jvnc.net!yale.edu!yale!gumby!wupost!howland.reston.ans.net!europa.eng.gtefsd.com!ulowell!wang!fitz
From: fitz@wang.com (Tom Fitzgerald)
Subject: Security bug in C news and INN
Organization: Wang Labs, Lowell MA, USA
Date: Thu, 10 Mar 1994 05:33:58 GMT
Message-ID: <CMFosn.2A5@wang.com>
Sender: news@wang.com
Nntp-Posting-Host: fnord.wang.com
Lines: 24