Security bug in C news and INN

Thread View: comp.security.misc

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by Tom Fitzgerald Thu, 10 Mar 1994 05:33

#1042

Author: Tom Fitzgerald
Date: Thu, 10 Mar 1994 05:33

22 lines
1915 bytes

If we're all in a security-bug-reporting mood here....  The news bug
reported on the bugtraq mailing list definitely affects AIX and SCO Unix
systems running the performance release of C news, or versions of INN older
than December 1993.

With this bug, if a newgroup article is posted containing a line beginning
with ~!  the rest of the line will be executed in a shell, as the 'news'
user.  The article is mailed to the news admin by piping it into mail, and
SCO's and AIX's /bin/mail understands ~ escapes.  The article doesn't even
need to be processed; if something is wrong with it, like it's missing an
Approved: header, it'll still be mailed to the admin and triggered.

INN sites should upgrade to inn1.4sec.tar.Z from uunet or elsewhere, if
they haven't already.

C news sites can fix the problem by inserting a sed 's/^~/~~/' in a
pipeline in front of the calls to 'mail' in the scripts that do newgroup
and checkgroups processing.

-- 
Tom Fitzgerald   Wang Labs   Lowell MA, USA   1-508-967-5278   fitz@wang.com
Pardon me, I'm lost, can you direct me to the information superhighway?

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads