Vulnerability Development: Re: /usr/bin/Mail buffer 0verfl0w

[Maciek Pasternacki <maciekp () JAPHY FNORD ORG>]

Syzop pressed following keys:
> Why is mail on some systems sgid?,
> It looks like it's something with locking files, but why doesn't mail
> to be sgid on other systems then?
AFAIK it has something to do with brain-dead idea of putting users' mail in
/var/spool/mail/login instead of /home/login/Mailbox (or, better, Maildir/).
To lock the file which is not in world-writeable directory, program has to be
setuid or setgid.

>    Syzop.
                --jph

-- 
__ Maciek Pasternacki <maciekp () japhy fnord org> [ http://japhy.fnord.org/ ]
`| _   |_\  / *CENSORED* ( full version at http://japhy.fnord.org/sig.txt )
,|{-}|}| }\/  
\/   |____/

Attachment: _bin
Description: