Re: INN1.4sec on Linux

• Messages sorted by: [ date ][ thread ][ subject ][ author ]
• Next message: Jim Wright: "Re: Ray Cromwell: Another Netscape Bug (and possible security"
• Previous message: Casper Dik: "Re: load.root (loadmodule hole)"
• In reply to: Olaf Kirch: "INN1.4sec on Linux"

In message <m0sue0r-00005AC@monad.swb.de>, Olaf Kirch writes:
>there's a problem with INN1.4sec as distributed on sunsite and probably
>a number of Linux distributions. Control messages are parsed by shell
>scripts, which (at least for some shells) allow remote users to execute
>arbitrary commands on your news host.

It should be noted that my INN 1.4unoff2 release includes a fix for
this.  As far as I know, it fixes the problem.

It doesn't include a fix for rnews, however.  I think rnews itself
should clear the environment itself and set the PATH.

--Dave

• Next message: Jim Wright: "Re: Ray Cromwell: Another Netscape Bug (and possible security"
• Previous message: Casper Dik: "Re: load.root (loadmodule hole)"
• In reply to: Olaf Kirch: "INN1.4sec on Linux"