WARNING: SCO-Xenix game "hack", setuid root
Oliver Boehmer
oli at odbffm.incom.de
Thu Apr 18 05:28:50 AEST 1991
Hi!
When I recently went through the setuid-files on my system, I found, that
/usr/games/lib/hackdir/hack (the actual nethack-program) is setuid-root.
This version is part of SCO-XENIX Games and was installed with this
permissions by the SCO-Utility custom.
HACK x4511 root/root 1 ./usr/games/lib/hackdir/hack 01
Hack allows shell escapes and I don't have to say what this means.
If it wouldn't be so serious, I'd laugh about this. But isn't it the right
filename for something like that?
Anyway, it's about time you go through your setuid-files
find / \( -perm -4000 -o -perm -6000 \) -print
oli
--
Oliver Boehmer, Frankfurt, Germany oli at odbffm.incom.de
+49-69-331461 (voice) +49-60-308265 (1200/2400)
If God is perfect, why did He create discontinuous functions?
More information about the Comp.unix.xenix.sco
mailing list