Re: XFree86 insecurity (fwd)

[Hamish Moffatt <hamish@debian.org>]

On Fri, Nov 21, 1997 at 09:02:11PM -0500, Tommy Lakofski wrote:
> Anyone know if debian is vulnerable to this, given that the setuid
> /usr/X11R6/bin/X is a wrapper for the XFree86 server?
> 
> I'd like to know before I chmod u-s /usr/X11R6/bin/X...

Just try it. I tried it here, and found it did not work.

[2:38pm] hamish@hamishpc:~> X -config /etc/shadow

Fatal server error:
Can't open option file /etc/shadow


When reporting a problem related to a server crash, please send
the full server output, not just the last messages


Thanks for forwarding this Tommy. You can make sure it reaches
the appropriate people by sending it to security@debian.org too.


Hamish
-- 
Hamish Moffatt, StudIEAust              hamish@debian.org, hmoffatt@mail.com
Student, computer science & computer systems engineering.    3rd year, RMIT.
http://hamish.home.ml.org/ (PGP key here)             CPOM: [******    ] 60%
Your train has been cancelled due to defective government at Spring Street..


--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-user-request@lists.debian.org . 
Trouble?  e-mail to templin@bucknell.edu .