[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Re: UUCP
From:       sirsyko () ishiboo ! com
Date:       2001-11-30 23:17:27
[Download RAW message or body]

On Fri, Nov 30, 2001 at 08:48:17AM -0500, Bob Howard wrote:
> Izik wrote:
> > 
> > Hello
> > 
> > i've found buffer overflow in uucp. in BSDi platform
> ...
> > since uucp is by nature suid. and the ownership is by uucp
> > i don't see the real profit.
> 
> Don't know about BSDi, but on Solaris uucp owns tip, uuencode, uudecode,
> and others.  So if I can use this vuln to su uucp, I can trojan e.g.
> tip.  Then the next time root runs what he thinks is tip, I've got the
> box.

on solaris:

$ grep uucp /etc/inetd.conf
uucp   stream  tcp     nowait  root    /usr/sbin/in.uucpd      in.uucpd
$ ls -ld /usr/sbin/in.uucpd
-r-xr-xr-x   1 uucp         9940 Jul 16  1997 /usr/sbin/in.uucpd

dunno if its the default, but it worked for me in 1995, and some boxes still
have this set up.

Adam

[prev in list] [next in list] [prev in thread] [next in thread]