Re: Majordomo /tmp exploit

From: Steven Pritchard (steveat_private)
Date: Thu Mar 26 1998 - 17:26:37 PST

Next message: Peter van Dijk: "easy DoS in most RPC apps"

Previous message: Michael Widenius: "FW: mysql: Trivial mSQL/MySQL DoS method? (fwd)"
Maybe in reply to: Karl G - NOC Admin: "Majordomo /tmp exploit"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Karl G - NOC Admin said:
> -=x-ploit=-
> create a symlink in /tmp to any majordomo file
> ex: ln -s /usr/lib/majordomo/majordomo /tmp/majordomo.debug

Looking at the latest version of majordomo (1.94.4), it seems the
problem isn't that bad.  A well-configured majordomo is not
vulnerable.  (By "well-configured", I mean where the admin has edited
majordomo.cf to change $TMPDIR to something not world-writable.  If
you haven't done that yet, do it now.)

I did find one case where majordomo doesn't honor the $TMPFILE
variable though.  Apply the following patch to fix it:

-- Cut here --

--- majordomo.pl.orig   Wed Aug 27 09:58:53 1997
+++ majordomo.pl        Thu Mar 26 18:42:29 1998
@@ -324,7 +324,7 @@
 }

 # These are package globals referenced by &setlogfile and &log
-$log_file = "/tmp/log.$$";
+$log_file = "$main'TMPDIR/log.$$";
 $log_host = "UNKNOWN";
 $log_program = "UNKNOWN";
 $log_session = "UNKNOWN";

-- end --

Enjoy.

Steve
--
steveat_private           | Linux Users of Central Illinois
(217)698-1694             | Meetings the 4th Tuesday of every month
Steven Pritchard          | http://www.luci.org/ for more info

Next message: Peter van Dijk: "easy DoS in most RPC apps"
Previous message: Michael Widenius: "FW: mysql: Trivial mSQL/MySQL DoS method? (fwd)"
Maybe in reply to: Karl G - NOC Admin: "Majordomo /tmp exploit"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:47:17 PDT