OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 3rd quarter (Jul-Sep) 1994: Re: IRIX 5.2 Security Advisory

Re: IRIX 5.2 Security Advisory

Marc W. Mengel (mengeldcdmwm.fnal.gov)
Tue, 09 Aug 94 16:19:01 -0600 

In <94Aug9.094422edt.11795cannon.ecf.toronto.edu>  you write:

    I am cc'ing this update to several mailing lists the advisory has been
    forwarded to since last week.

    Steve Kotsopoulos <steveecf.toronto.edu> wrote:
    >I'm not sure what the vulnerability is, since the sgihelp.books.ViewerHelp
    >system doesn't seem to contain anything but data files with normal
    >permissions (no setuid programs).
    >
    >How can the removal of this subsystem affect security?
    >Was there a typo in the advisory, perhaps?

Lots of the setuid GUI admin programs lurking around the system invoke
it to provide help.  It has a print menu with a "pipe to command" option.

'nuff said.

Marc