Re: sendmail exploit script - resend

[crow!rik () uunet uu net (Rik Farrow)]

> > # this program will be executed when mail is sent to the fake alias.
> > # since solaris sh and csh and tcsh refuse to run when euid != realuid,
> > # we instead run the program we compiled above.
>
> Does anyone know quite what the logic behind these shell checks are? They're
> just a pain and a stumbling block that are trivial to work around. Is it only
> Sun derived things that do this?

SVR4 is the source of this behavior, and includes the Korn shell in the
list of programs which check for euid != realuid.  And Solaris 2.x is SVR4
related.

Rik Farrow