Xref: utzoo comp.unix.questions:9663 comp.bugs.sys5:614
Path: utzoo!utgpu!water!watmath!clyde!ima!minya!jc
From: jc@minya.UUCP (John Chambers)
Newsgroups: comp.unix.questions,comp.bugs.sys5
Subject: Re: Dangers of vi & passwd (Was Re: SVR3 passwd changes mode of passwd file)
Message-ID: <106@minya.UUCP>
Date: 10 Oct 88 23:17:20 GMT
References: <3394@dunkshot.mips.COM> <1235@cbnews.ATT.COM> <195@taux02.UUCP>
Organization: (none)
Lines: 29

In article <195@taux02.UUCP>, amos@taux02.UUCP (Amos Shapir) writes:
> In article <13215@hqda-ai.ARPA> jay@hqda-ai.ARPA (Jay Heiser) writes:
> >CCI, our SysV vender, has just posted a bulletin warning that vi has
> >an undocumented feature.  "[it was] designed to look for the
> >occurrence of a line that starts with the string "ei:" and use the
> >characters following the ei: as editor commands.  This is NOT
> >documented."
> >
> >In other words, if someone on your system has a userid 'ei',
> >unexpected things will happen if you use vi to edit the password file.
> >The bulletin only warns about SysV versions of vi (specifically on
> >tahoes and Power 5/32s).

A couple years back, a general bulletin was broadcast warning people to
eradicate all versions of vi with this feature.  The above problem is a
minor problem compared to what could be done with it.  Consider the effect
of persuading a super-user to use vi to read file that ended with lines like:
	vi:!rm -rf /*unix*
	vi:q!
There were several other amusing examples, such as invoking mail, changing
ownership of files in /etc, and so on, often ending with a command to delete
the vi: lines so the victim wouldn't see them.


-- 
John Chambers <{adelie,ima,maynard,mit-eddie}!minya!{jc,root}> (617/484-6393)

[Any errors in the above are due to failures in the logic of the keyboard,
not in the fingers that did the typing.]