bugtraq - Re: possible local exploit via sendmail with procmail on solaris

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200412222224.iBMMOuXd021613@ebbets.poly.edu>
Date: Wed, 22 Dec 2004 17:24:56 -0500 (EST)
From: Jeff Damens <jdamens@...ets.poly.edu>
To: mbarnes@...psci.wm.edu
Cc: bugtraq@...urityfocus.com
Subject: Re: possible local exploit via sendmail with procmail on solaris

Mike,

Sendmail is *supposed* to run the local mailer setuid as the
recipient, so procmail should have run as you.  I'm running sendmail
8.13.1 on solaris 7 & 8 and it does seem to setuid properly.  

Is it possible that procmail itself is setuid root and is invoking the
shell which is sourcing your .cshrc?  It would be interesting to see a
truss -f of sendmail doing a local delivery.

$h is the host as set from the 2nd part of the $# local mailer rule.
It probably isn't set in your sendmail rules for local users.  

Regards,

Jeff

----------------------------------------------------------------

Jeff Damens                     Unix Systems Administrator
Polytechnic University          jdamens@...ets.poly.edu
6 Metrotech                     (718) 260-3492
Brooklyn, New York 11201