OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 3rd quarter (Jul-Sep) 1998: Re: About rpc.* programs and SIGUSR1 signal...

Re: About rpc.* programs and SIGUSR1 signal...

Chris Frey (cdfreyfoursquare.net)
Sat, 26 Sep 1998 12:21:40 -0400

On Fri, 25 Sep 1998, ga wrote:

> Finally, this reminded me of an old DoS that I found long time ago but I
> never
> released it (sorry if it is already known). This was based on the same
> USR1
> signal. When sendmail receives a SIGUSR1 signal, it dumps some infos in
> the
> /var/log/debug file. As sendmail is suid then it runs with root
[snip]
> I tried this on sendmail 8.8.0 (as I told you above, it has been a
> longtime).

I checked my copies of sendmail-8.8.6 and sendmail-8.9.1 that I had
available and it looks to me like it uses syslog to do the state dump on a
SIGUSR1.

I don't have 8.8.0 to check with, but perhaps syslog was setup to write
LOG_DEBUGs to /var/log/debug?

- Chris