security of fileutils (Re: Release of 2.4.21)

[Pavel Machek <pavel@suse.cz>]

Hi!

> This specific ptrace hole is closed, yay.  Now what about the other
> 10,001 that still exist?  People are blowing this ptrace bug WAY
> out of proportion.   The only reason why it demands a modicum of
> vendor responsibility is that a-holes are making easy-to-use exploits
> available for the script kiddies.
> 
> In my more cynical moods, I wish bugtraq'ers would start posting
> exploits to all the races in GNU coreutils (cp/mv/rm/...).  Assuming
> such actions would (finally) lead to bug fixes.... maybe then I will
> start taking local root holes a bit more seriously.  I will no more
> than hint about this in public, but will respond privately with details
> (if I know you).

Can you give me the details? I can
imagine holes like "if I can force root
to rm -rf /tmp/my-dir while my scripts
are running, I can rm whatever I want"
and probably could force root to cp
files he did not want to copy, but that
would require a *lot* of social ingeneering...
Unlike ptrace which seems to be "gimme root, now!"
case.
				Pavel
(I left l-k in cc, you may want to strip it)
-- 
				Pavel
Written on sharp zaurus, because my Velo1 broke. If you have Velo you don't need...