[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: LYNX-DEV Alleged Lynx security emergency
From: |
Wayne Buttles |
Subject: |
Re: LYNX-DEV Alleged Lynx security emergency |
Date: |
Tue, 1 Jul 1997 15:19:51 -0400 (EDT) |
On Tue, 1 Jul 1997, Foteos Macrides wrote:
> I'm not sure what you mean by "it". I'm the one who trashed
> Scott's /dev/null trying out the spoofing LYNXDOWNLOAD: URL running
> Lynx from a non-privileged account. Are you saying that an
> fd = fopen("/dev/null", "w"); fclose(fd); remove("/dev/null");
> sequence doing that, if that's it (haven't tried it explicitly :),
> is normal on Unix, and if not, how did I do it?
The following as root will trash /dev/null
#include <stdio.h>
main()
{
FILE *fd;
fd = fopen("/dev/null", "w"); fclose(fd); remove("/dev/null");
}
It will also trash /dev/null (on linux) as root su'd to a normal user. If
the system you are on gives normal users write access to that file then
that also may open it up for trashing.
Wayne
;
; To UNSUBSCRIBE: Send a mail message to address@hidden
; with "unsubscribe lynx-dev" (without the
; quotation marks) on a line by itself.
;
- Re: LYNX-DEV Alleged Lynx security emergency, (continued)
- Re: LYNX-DEV Alleged Lynx security emergency, Jim Dennis, 1997/07/01
- Re: LYNX-DEV Alleged Lynx security emergency, H E Nelson, 1997/07/01
- Re: LYNX-DEV Alleged Lynx security emergency, Foteos Macrides, 1997/07/01
- Re: LYNX-DEV Alleged Lynx security emergency, Foteos Macrides, 1997/07/01
- Re: LYNX-DEV Alleged Lynx security emergency,
Wayne Buttles <=
- Re: LYNX-DEV Alleged Lynx security emergency, Scott McGee (Personal), 1997/07/01
- Re: LYNX-DEV Alleged Lynx security emergency, H E Nelson, 1997/07/01
- Re: LYNX-DEV Alleged Lynx security emergency, H E Nelson, 1997/07/01
- Re: LYNX-DEV Alleged Lynx security emergency, Bela Lubkin, 1997/07/03