a Patch available for local root exploit

Contributed by Dengue on 2000-10-04 from the format-string-bugs-bite-again dept.

There is a new patch available to correct a local root exploit in chpass . All systems with local users are advised to update immediately. As a work-around, until your system can be patched, it is recommended that you

# chmod u-s /usr/bin/chpass

As always, instructions for patching your system are contained in the patch itself. This affects OpenBSD 2.7 and presumably prior versions as well. Users of -current after July 1 are safe.

Exploits in the wild for this bug became known on October 2.

(Comments are closed)

Comments

By jslag () jslag@visi.com on 2000-10-04 23:16 mailto:jslag@visi.com

"Only one localhost hole in two years..." doesn't sound quite as good as "Two years without a localhost hole", but I give the team big points for honesty.
By sessya () on 2000-10-06 02:16

from securityfocus it is said that the affected code is part of a
library.

is chpass the only application that uses this library? or are there
any other?

i am currently setting up a server that will handle email, and act
as a bastion. i am going to use OBSD 2.7.

also are the OBSD2.8 snapshots stable enough for a production
server? the OBSD2.8 branch is not affected accdg to securityfocus.

yorosiku,
sessya.

Latest Articles

Sat, Nov 30
- 18:42 Initial list of 21 EuroBSDcon 2024 videos released (0)
- 18:39 Rafael Sadowski on dpb(1) (1)
Fri, Nov 29
- 09:31 -current now has more flexible performance policy (0)
Mon, Nov 25
- 07:13 unwind: wildcard in blacklist (0)
Fri, Nov 22
- 07:33 Game of Trees 0.106 released (0)
Fri, Nov 15
- 06:51 Game of Trees 0.105 released (0)
Wed, Oct 23
- 07:12 Game of Trees 0.104 released (0)
Tue, Oct 15
- 08:46 LibreSSL 4.0.0 Released (0)
Mon, Oct 14
- 07:05 sshd(8) splitting continues (1)

Credits

Copyright © 2004-2008 Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to April 2nd 2004 as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]