Re: majordomo local exploit

> The following patch, built upon code and suggestions submitted by
> Henrik Edlund, Henrik Nordstrom, and Andrew Brown, is intended to render
> safe the config file requires, in the seven scripts which use them, in
> the Majordomo 1.94.4 home directory. It also incorporates Todd Miller's
> patch of Dec. 29.

This doesn't address the problem on Unixen that allow one to 'give
away' files. Nor is it compatible with the philosophy that majordomo
1.x should continue to run under perl4.

The proper fix appears to be simply 'chmod 0750 wrapper', perhaps
along with setting the group owner of wrapper to the same as the MTA.

And, of course, restricting access to the majordomo server.

--Chan
        majordomo maintainer.
Received on Jan 07 2000