Bugtraq: Possible Ultrix issue

[dan () dan com (dan)]

        I've just discovered that on Ultrix systems with X11 libs installed
yet lacking a /dev/xcons, /usr/lib/X11/xconsole can be used to destructively
overwrite any file on the system. To duplicate, set display to a working 
server, create a symbolic link from /tmp/Xconsole.log to the file to be 
overwritten, and run xconsole. The target file will be overwritten with a
single line error message concerning the nonexistance of /dev/xcons. 
        I believe the problem can be eliminated by creating a root 
read-writeable touchfile as /dev/xcons. 

        I havent had very much opportunity to play with this one yet, it may
have some other possibilities. 
        
        dan

-- dan cohn \ dan () dan com