OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Florian Weimer (Weimer_at_CERT.Uni-Stuttgart.DE)
Date: Tue Sep 03 2002 - 13:44:47 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    pszmaths.usyd.edu.au (Paul Szabo) writes:

    > I have reported this to Compaq (but expect no speedy resolution). I am
    > puzzled: why patch /sbin/mount or /usr/bin/csh if they are not setuid?

    Paul confirmed in private email that /sbin/mount is statically linked.
    I guess that it contains a copy of the RPC code for NFS mounts.
    xdr_array() is actually used for interaction with rpc.mountd, so a new
    /sbin/mount binary was needed to remove a potential threat.

    (I haven't got access to a Tru64 system, so this is pure, albeit
    plausible speculation.) 

    -- 
Florian Weimer 	                  WeimerCERT.Uni-Stuttgart.DE
University of Stuttgart           http://CERT.Uni-Stuttgart.DE/people/fw/
RUS-CERT                          fax +49-711-685-5898