Vulnerability Development: Re: nonsuid overflows... still at risk?

[Michal Zalewski <lcamtuf () bos bindview com>]

On Wed, 6 Jun 2001, KF wrote:

> exactly what I was thinking... crontab -e calls vi to open the users
> crontab... this is why I was wondering if it could be exploited due to
> the fact that crontab is suid.
Not really. As long as crontab itself is not broken, it should invoke vi
without additional priviledges. Otherwise, you can always type ':!sh' in
command mode and you do not need buffers overflows to do that.

-- 
_____________________________________________________
Michal Zalewski [lcamtuf () bos bindview com] [security]
[http://lcamtuf.coredump.cx] <=-=> bash$ :(){ :|:&};:
=-=> Did you know that clones never use mirrors? <=-=