Re: [cobalt-security] Some more....

[Gossi The Dog <gossi@xxxxxxxxxxxxxx>]

Hi.  This was discovered in April.

More information at http://linux.dp.ua/maillist/msg00001.html

I will test it on my RaQ 3...

Regards,
Gos.

On Mon, 24 Jul 2000, Thomas Fosbenner Jr. wrote:

> Here is an excerpt from the actual code of that program.
> Maybe this has been fixed but I haven't heard anything about it.
> Let me know if I am a moron and am behind the times or let me know if I
> enlightened you.
>  Thanks
> 
> [Actual Comment From the Code]
> 
> # synopsis:
> #    both 'pam' and 'userhelper' (a setuid binary that comes with the
> #    'usermode-1.15' rpm) follow .. paths. Since pam_start calls down to
> #    _pam_add_handler(), we can get it to dlopen any file on disk.
> 'userhelper'
> #    being setuid means we can get root.
> 
> 
> PS. There is actually another program that I had with this one that does
> almost the same thing. I can send that also.
> 
> 
> 
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security
> 

-- 
gossi@xxxxxxxxxxxxxxx