On Fri, Nov 17, 2000 at 07:54:26AM -0600, An Thi-Nguyen Le wrote: > On Fri, Nov 17, 2000 at 03:46:19AM -0900, Ethan Benson typed: > } On Fri, Nov 17, 2000 at 12:36:54PM +0000, thomas lakofski wrote: > } > fyi -- i've not tried it. > } > } i have, it does not work, i tried several different variations and > } failed to create any files in /var/spool/cron. > } > } i do not believe debian is vulnerable. > > Wrong, we *are* vulnerable. Take a look /var/spool/cron/crontabs > instead. ah, your right, however this is not exploitable since /var/spool/cron/crontabs is mode 700. still should be fixed though. -- Ethan Benson http://www.alaska.net/~erbenson/
Attachment:
pgpFG2f9XILmO.pgp
Description: PGP signature