Xref: utzoo comp.sys.next:4946 alt.flame:15159
Path: utzoo!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!tut.cis.ohio-state.edu!ucbvax!ziploc!eps
From: eps@toaster.SFSU.EDU (Eric P. Scott)
Newsgroups: comp.sys.next,alt.flame
Subject: Re: Question about setuid bit
Message-ID: <300@toaster.SFSU.EDU>
Date: 5 Feb 90 22:42:57 GMT
References: <1990Feb3.015340.20467@csustan.CSUStan.Edu> <291@toaster.SFSU.EDU> <7818@pt.cs.cmu.edu> <15476@orstcs.CS.ORST.EDU> <7846@pt.cs.cmu.edu>
Reply-To: eps@cs.SFSU.EDU (Eric P. Scott)
Followup-To: comp.sys.next
Organization: San Francisco State University
Lines: 35

In article <7846@pt.cs.cmu.edu> jgm@fed.expres.cs.cmu.edu
	(John G. Myers) writes:
>I'd rather not give information on how to exploit the bug.

Understandable, given that this is a public forum.

HOWEVER--you are not giving the readership enough information to
draw reasonable conclusions and arrive arrive at informed decisions.

A phrase like "semantics inherent in shell scripts" is hopelessly
vague; you never differentiate whether the "interpreter hack"
(Using #! as the "magic number" to specify which native
executable should be execed with the script as input) is flawed,
or whether there's a stupid coding error in the existing shell(s)
that is deemed impractical to fix.  It really seems that removing
a potentially quite useful feature is the wrong approach when
perhaps better alternatives exist.  As it stands, you're just
pandering to fear and ignorance.  It's a fair assumption that
most comp.sys.next readers don't know beans about UNIX internals,
and the popular press has gone hog-wild in the past year or so
with "computer crime" stories that mostly breed rampant paranoia.
(Yes, I know Berkeley's quality control leaves much to be
desired, that's not the point.)

In any case, you should send a full report to NeXT, with examples
illustrating the problem, and let them worry about how best to
handle it.  This isn't a popularity contest.

In the meantime, simply not using setuid shell scripts seems the
simplest and most obvious course of action.  True paranoids can
use  ncheck -s  to round up the usual suspects.

					-=EPS=-
-- 
"It hurts when I do this."  "Don't do that."