The 'Security Digest' Archives (TM)

Archive: About | Browse | Search | Contributions | Feedback
Site: Help | Index | Search | Contact | Notices | Changes

ARCHIVE: 'Phage List' - Archives (1988 - 1989)
DOCUMENT: phage #262 [~uucp/.forward] (1 message, 728 bytes)
SOURCE: http://securitydigest.org/exec/display?f=phage/archive/262.txt&t=text/plain
NOTICE: securitydigest.org recognises the rights of all third-party works.

START OF DOCUMENT

From: der Mouse <mouse@larry.mcrcim.mcgill.edu>
To: phage
Date: Fri 00:51:46 18/11/1988 EST
Subject: ~uucp/.forward
References: [Thread Prev: 260] [Thread Next: 289] [Message Prev: 260] [Message Next: 263]

> If a UUCP neighbor deposited into ~uucp/.forward a file containing
>	"|/bin/sed -e '1,/^$/d'|/bin/sh"
> (which they might be able to do it your ~uucp is uucp-writable as
> most are), and then sent mail to your uucp account, what do you
> expect would happen?

(groan.  Well, at least I'd rather know about it than not....)

> Anybody got an idea for a fix?

Some ideas follow; I don't know how well (if at all) they'd work.

- Create ~uucp/.forward, owner root mode 444, pointing to wherever you
  want.

- Create ~uucp/.forward as a symlink to somewhere nonexistent, as in
	ln -s /foo/bar/baz/blech ~uucp/.forward

- Make a directory ~uucp/.forward (now why does this remind me of
  /usr/tmp/sh? :-).

- Make sendmail ignore .forward files if the directory they're in is
  globally writeable.  This doesn't help if ~uucp is owner uucp mode
  755, of course.

- Trust your uucp neighbors.

					der Mouse

			old: mcgill-vision!mouse
			new: mouse@larry.mcrcim.mcgill.edu

END OF DOCUMENT