Message from Michal Zalewski at Jul 5 14:20 in parts: MZ> For script kiddiez, here's an exploit for recent vixie-cron vulnerability, MZ> giving instant root shell. Thought it will help script kiddies, but as MZ> Martin Schulze included almost step-by-step guide how to abuse Sendmail MZ> flags, this exploit won't bring anything shocking - simply, it's working MZ> example. man sendmail: /-C ...skipping... -Cfile Use alternate configuration file. Sendmail refuses to run as root if an alternate configuration file is specified. and it does, for sure %-). Just tested this on different versions of FreeBSD and had no effects except Mail Delivery message: The following address has permanent fatal errors: -C/tmp/vixie-cf gvs So, sendmail _really_ refuses to accept -C key when run as root SY, Seva Gluschenko, just stranger at the Road. | http://gvs.rinet.ru/ Cronyx Plus / RiNet network administrator. | GVS-RIPE | GVS3-RIPN
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:01:11 PDT