Article View: comp.security.misc
Article #482Re: Setuid script - is this unsecure?
From: Michal Jankowski
Date: Sat, 07 Nov 1992 15:36
Date: Sat, 07 Nov 1992 15:36
20 lines
1135 bytes
1135 bytes
>>>>> On 5 Nov 92 23:15:51 GMT, carl@montebello.ecom.unimelb.EDU.AU
>>>>> (Carl Brewer) said:
>In: (mount script)
Carl> [irrelevant script contents deleted]
Carl> this is the oldest crack trick in the book, and is in the FAQ
Carl> Suggest you read it, the bit on creating a symbolic link
Carl> to the script from a file called "-i" ...
Carl> you may find that informative
Well, it is NOT irrelevant that his scripts start with
#!/bin/sh --
Please note the '--'. The '-i' trick won't work.
There are however other ways to break his scripts.
Michal
Technical Details
Message-ID:
<MICHALJ.92Nov7163644@ccfs1.fuw.edu.pl>Path:
arc1-ca.pugleaf.net!sparky!uunet!mcsun!sunic!fuw.edu.pl!cocos!michaljReferences:
<1d6fdiINNf5q@bnsgd245.bnr.co.uk> <9231110.9860@mulga.cs.mu.OZ.AU>Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc Path: arc1-ca.pugleaf.net!sparky!uunet!mcsun!sunic!fuw.edu.pl!cocos!michalj From: michalj@fuw.edu.pl (Michal Jankowski) Subject: Re: Setuid script - is this unsecure? In-Reply-To: carl@montebello.ecom.unimelb.EDU.AU's message of 5 Nov 92 23:15:51 GMT Message-ID: <MICHALJ.92Nov7163644@ccfs1.fuw.edu.pl> Sender: news@fuw.edu.pl Nntp-Posting-Host: ccfs1 Organization: Warsaw University Physics Dept. References: <1d6fdiINNf5q@bnsgd245.bnr.co.uk> <9231110.9860@mulga.cs.mu.OZ.AU> Date: Sat, 7 Nov 1992 15:36:44 GMT Lines: 21