Bugtraq: Re: Root shell vixie cron exploit

[gvs () RINET RU (Seva Gluschenko)]

Message from Michal Zalewski at Jul 5 14:20 in parts:

 MZ> For script kiddiez, here's an exploit for recent vixie-cron vulnerability,
 MZ> giving instant root shell. Thought it will help script kiddies, but as
 MZ> Martin Schulze included almost step-by-step guide how to abuse Sendmail
 MZ> flags, this exploit won't bring anything shocking - simply, it's working
 MZ> example.

man sendmail:
/-C
...skipping...
        -Cfile  Use alternate configuration file.  Sendmail refuses to run
                as root if an alternate configuration file is specified.

and it does, for sure %-).

Just tested this on different versions of FreeBSD and had no effects
except Mail Delivery message:

The following address has permanent fatal errors:
-C/tmp/vixie-cf gvs

So, sendmail _really_ refuses to accept -C key when run as root

SY, Seva Gluschenko, just stranger at the Road. | http://gvs.rinet.ru/
Cronyx Plus / RiNet network administrator.      | GVS-RIPE | GVS3-RIPN