Re: A vulnerability in Lynx (all versions)

Luca Berra (bluca@comedia.it)
Tue, 06 May 1997 13:57:55 +0200

Messages sorted by: [ date ][ thread ][ subject ][ author ]
Next message: Aleph One: "Alert: Sec. Vuln. in libXt for HP-UX 9.X & 10.X"
Previous message: SGI Security Coordinator: "SGI Security Advisory 19970501-01-A - Vulnerability in webdist.cgi"
Maybe in reply to: fflush: "A vulnerability in Lynx (all versions)"

Actually, for those out there running linux, someone
(Andrew tridgell if i remember correctly)
wrote a kernel patch to completely disable symlinks in
tmp attacks.
basically it does not follow any symlinks (in directories
with the sticky bit set) if the owner of the link is different
than the owner of the target.

i think something like this should be implemented in
other OSes as well.

Regards
Luca

--
Luca Berra -- bluca@comedia.it
        System and Network Manager - CoMedia s.r.l.
           PGP Public key available via finger

Next message: Aleph One: "Alert: Sec. Vuln. in libXt for HP-UX 9.X & 10.X"
Previous message: SGI Security Coordinator: "SGI Security Advisory 19970501-01-A - Vulnerability in webdist.cgi"
Maybe in reply to: fflush: "A vulnerability in Lynx (all versions)"