Re: Potential security problem with mtr

From: Viktor Fougstedt (viktorat_private)
Date: Sat Mar 04 2000 - 12:13:03 PST

  • Next message: Zoa_Chien: "OFFICIAL RELEASE of the [device]\[device] advisory"

    On Sat, 4 Mar 2000, Rogier Wolff wrote:
    
    > Viktor Fougstedt wrote:
    > > mtr-0.28 seems to be a standard package in some Linux distributions,
    > > but it is not known whether it is installed setuid-root.
    >
    > 0.41 is current.
    
    0.41 was the version I tried. I'm sorry I didn't make that
    clearer. The mentioning of 0.28 comes from the fact that that is the
    version distributed with Debian. 0.41 has the same problem, though.
    
    > > The authors have been contacted, but no reply has been received. The
    > > latest version is from Aug 19 1999, and I am uncertain whether mtr is
    > > still being actively developed.
    >
    > I'm the maintainer. I haven't been contacted. Viktor, may I ask you to
    > do your homework a bit better next time?
    
    You may certainly. According to the file AUTHORS in the 0.41
    distribution, bug reports should be sent to the mtr mailing list. And
    the file README in the same tarball gives this address as
    mtrat_private I sent a message to that address on Wed, 2 Feb
    2000 20:13:40 +0100. I received no response to that mail. If this was
    not the correct address, may I ask that the information in the AUTHORS
    and README files be updated to contain correct information?
    
    
    /Viktor...
    
    --|     Viktor Fougstedt, system administrator at dtek.chalmers.se     |--
    --|                http://www.dtek.chalmers.se/~viktor/                |--
    --| ...soon we'll be sliding down the razor blade of life. /Tom Lehrer |--
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:39:03 PDT