rcs2log

From: Morten Welinder (terraat_private)
Date: Tue Aug 07 2001 - 13:10:05 PDT

Next message: Marek Roy: "Internal IP Address Disclosure in Microsoft-IIS 4.0 & 5.0"

Previous message: Nick FitzGerald: "Re: Adobe PDF files can be used as virus carriers"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I have been sitting on this one for half a year.  Time to disclose
it.

rcs2log uses files in /tmp insecurely.

This was reported to the Emacs maintainers an aeon or two ago.
Current preleases have a fix.  (And have had it for at least half
a year.)

NOTE NOTE NOTE: there seem to be quite a few sources for rcs2log
out there.  A SuSE 6.3 (I think) seems to install three different
versions in four different spots.

Morten


xyz:~> ls -l `locate rcs2log`
-rwxr-xr-x   1 root     root        17927 Nov  8  1999 /usr/bin/rcs2log
-rwxr-xr-x   1 root     root        17927 Nov  8  1999 /usr/lib/cvs/contrib/rcs2log
-rwxr-xr-x   1 root     root        17902 Nov  8  1999 /usr/lib/emacs/20.4/i386-suse-linux/rcs2log
-rwxr-xr-x   1 root     root        17357 Feb  8  2001 /usr/lib/xemacs/21.1.10/i386-suse-linux/rcs2log

Next message: Marek Roy: "Internal IP Address Disclosure in Microsoft-IIS 4.0 & 5.0"
Previous message: Nick FitzGerald: "Re: Adobe PDF files can be used as virus carriers"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Aug 07 2001 - 13:55:06 PDT