hi, x11 audio mpeg player (x11amp) version 0.65, when installed setuid root (as suggested by the README file), creates playlist files in ~/.x11amp while making 'root' the owner of these plaintext files (instead of the proper user). unfortunatelly, the program DOES follow symlinks, and overwriting for instance /etc/shadow is therefore trivial: mkdir ~/.x11amp ln -s /etc/shadow ~/.x11amp/ekl now run x11amp, get into the playlist menu, select 'ekl', mark all the entries and hit 'delete'. no matter if the prg crashes (it might), /etc/shadow is gone, anyway. viinikala/rvl&grif <kalaat_private> i could wrap you up in cotton wool.
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:43:29 PDT