[Full-Disclosure] Re: Compaq mount patch broken

From: Florian Weimer (Weimerat_private-Stuttgart.DE)
Date: Tue Sep 03 2002 - 11:44:47 PDT

Next message: Dave Ahmad: "[security bulletin] SSRT2310a HP Tru64 UNIX & HP OpenVMS Potential OpenSSL Security Vulnerability (fwd)"

Previous message: Shaolin Tiger: "Re: SUMMARY: Disabling Port 445 (SMB) Entirely"
In reply to: Paul Szabo: "[Full-Disclosure] Compaq mount patch broken"
Next in thread: Paul Szabo: "[Full-Disclosure] Re: Compaq mount patch broken"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

pszat_private (Paul Szabo) writes:

> I have reported this to Compaq (but expect no speedy resolution). I am
> puzzled: why patch /sbin/mount or /usr/bin/csh if they are not setuid?

Paul confirmed in private email that /sbin/mount is statically linked.
I guess that it contains a copy of the RPC code for NFS mounts.
xdr_array() is actually used for interaction with rpc.mountd, so a new
/sbin/mount binary was needed to remove a potential threat.

(I haven't got access to a Tru64 system, so this is pure, albeit
plausible speculation.)

-- 
Florian Weimer 	                  Weimerat_private-Stuttgart.DE
University of Stuttgart           http://CERT.Uni-Stuttgart.DE/people/fw/
RUS-CERT                          fax +49-711-685-5898
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Next message: Dave Ahmad: "[security bulletin] SSRT2310a HP Tru64 UNIX & HP OpenVMS Potential OpenSSL Security Vulnerability (fwd)"
Previous message: Shaolin Tiger: "Re: SUMMARY: Disabling Port 445 (SMB) Entirely"
In reply to: Paul Szabo: "[Full-Disclosure] Compaq mount patch broken"
Next in thread: Paul Szabo: "[Full-Disclosure] Re: Compaq mount patch broken"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Sep 03 2002 - 12:32:18 PDT