Patch SSRT0583U to /usr/bin/mh/inc has incorrect instructions

From: Lamont Granquist <lamontg_at_raven.genome.washington.edu>
Date: Thu, 04 Feb 1999 11:10:15 -0800

The SSRT0583U patch instructions (v4.0d/README) tell the sysadmin to:

| The following instructions assume the patched files are in directory
| /patches.

[...]

| # cd /usr/bin/mh
|
| # cp /patches/inc inc.new
| # chown root:bin inc.new
| # chmod 4755 inc.new
| # ln inc inc.orig
| # mv inc.new inc

This will, of course, leave /usr/bin/mh/inc.orig the old still-suid
binary. chmod u-s /usr/bin/mh/inc.orig will fix the patch. It *is*
probably a good idea to keep the original files around so that they can be
replaced when installing the next patch kit (to fix those "origin of file
/blah/foo unknown, skipping patch..." errors).

Thanks to Bob Vickers for drawing this to my attention...

Compaq has been notified...

-- 
Lamont Granquist                       lamontg_at_raven.genome.washington.edu
Dept. of Molecular Biotechnology       (206)616-5735  fax: (206)685-7344
Box 352145 / University of Washington / Seattle, WA 98195
PGP pubkey: finger lamontg_at_raven.genome.washington.edu | pgp -fka
---------- Forwarded message ----------
Date: Thu, 4 Feb 1999 10:08:46 +0000 (GMT)
From: Bob Vickers <bobv_at_dcs.rhbnc.ac.uk>
Reply-To: R.Vickers_at_dcs.rhbnc.ac.uk
To: Lamont Granquist <lamontg_at_raven.genome.washington.edu>
Subject: Re: This Buffer Overflow thing...
Lamont,
The patch SSRT0583U does NOT solve the problem. It makes the classic
mistake that everyone makes the first time they write a patch for a
security hole in a setuid program: it carefully preserves the old
dangerous program along with its setuid permission in a file with a
different name (in this case something.orig).
In keeping with the conventions of alpha-osf-managers I'm leaving it to
you to warn everybody else.
Bob
==============================================================
Bob Vickers                     R.Vickers_at_dcs.rhbnc.ac.uk
Dept of Computer Science, Royal Holloway, University of London
WWW:    http://www.cs.rhbnc.ac.uk/home/bobv
Phone:  +44 1784 443691

Received on Thu Feb 04 1999 - 19:11:07 NZDT