movemail bug?

Thread View: gnu.emacs.bug

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by D.Peakall Thu, 21 Jan 1993 23:03

#948

Author: D.Peakall
Date: Thu, 21 Jan 1993 23:03

8 lines
933 bytes

I've been unable to persuade my sysadmin to make the movemail routine
setuid because they believe it will compromise system security.  I
assume that they are referring to the bug that I seem to remember
being described in Clifford Stoll's book `The Cukoo's Egg'.  We have
version 18.58.1 for berkeley unix.  Is this still a problem?

Dale Peakall
plyidp@mips.ccc.nottingham.ac.uk

Re: movemail bug?

#972

Author: Jym Dyer
Date: Tue, 26 Jan 1993 01:50

29 lines
1782 bytes

> I've been unable to persuade my sysadmin to make the movemail
> routine setuid because they believe it will compromise system
> security.  I assume that they are referring to the bug that
> I seem to remember being described in Clifford Stoll's book
> `The Cukoo's Egg'.

=o= That problem's been fixed long ago.  See the file FAQ in
the Emacs etc directory.  I quote:

>  1. the `movemail' incident (No, this is not a risk.)
>
>     Cliff Stoll in his book "The Cuckoo's Egg" describes this in chapter 4.
>     The site at LBL had installed the `etc/movemail' program setuid root.
>     Since `movemail' had not been designed for this situation, a security
>     hole was created and users could get root priveleges.
>
>     `movemail' has since been changed so that even if it is installed
>     setuid root this security hole will not be a result.

=o= It should be noted that Stoll's description of the cause of
the problem is exactly the opposite of reality:  He claimed that
the security hole was a bug in movemail, and contrasted it with
security holes caused by sysadmins installing things wrong.  As
we can see above, the problem actually *was* caused by sysadmins
installing things wrong.

=o= Stoll should write an apology/retraction, and should see to
it that it's distributed widely.
    <_Jym_>

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads