Vulnerability Development: Re: Some work needed

[White Vampire <whitevampire () mindless com>]

On Sun, Aug 06, 2000 at 07:15:15PM -0500, Jonathan Leto(jonathan () leto net) wrote:
: Is there any suggested fix for this and have the perl people been notified?

        There are all sorts of suggested fixes.  First of all, simply
remove the SUID bit from /usr/bin/suidperl*.

        If you really need to keep the SUID bit you can use a binary
replace as an adequate fix as suggested by Paul Szabo on Bugtraq:

  cd /usr/local/bin
  cp -i suidperl suidperl.ORIG
  perl -pe 's/mail root/NOmailZZZ/' < suidperl.ORIG > suidperl
  chmod 4711 suidperl

        One of those two fixes should suit your needs.  I suggest
reading the Bugtraq archive at http://www.securityfocus.com/ for more
information.

Regards,
-- 
    __      ______   ____
   /  \    /  \   \ /   / White Vampire\Rem
   \   \/\/   /\   Y   /  http://www.projectgamma.com/
    \        /  \     /   http://www.webfringe.com/
     \__/\  /    \___/    http://www.gammaforce.org/
          \/ "Silly hacker, root is for administrators."

Attachment: _bin
Description: