OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: HP Security vulnerability in the man command
From: Philipp Buehler (listsFIPS.DE)
Date: Tue Jun 06 2000 - 03:56:31 CDT

Theo de Raadt wrote To BUGTRAQSECURITYFOCUS.COM:
> > 0) HP *still* insists on NOT setting the sticky bit on world-writeable
> > temporary directories (/tmp and /var/tmp) on default installs of HPUX.
> If this is the case, then any temporary file which gets reopened is
> not safe. A *lot* of software does reopening by name.
Handling temporary files is broken in so many scripts .. e.g. I just
*wait* for the next broken Oracle installer for such a hole.

Other point. I have 2 "default" installed HP-UX 10.20 boxes and I
*have* the sticky bit set on /tmp which cures the problem by itself.
Well, the behaviour of `man' is not nice anyway.

Could the original poster elaborate on his "default" installation?
I could only think of installations which are no TCB HP-UX. I will
check the change logs, but I don't think the +t depends on that.
You *should* use TCB anyway on HP-UX, or how do you want to manage
"shadowed" passwords there properly?
Or do you really want to live with word readable hashed passwords?

ciao 

--
Philipp Buehler, aka fIpS | sysfive.com GmbH i.G. | BOfH | NUCH | <double-p>

%SYSTEM-F-TOOEARLY, please contact your sysadmin at a sensible time.
Artificial Intelligence stands no chance against Natural Stupidity.