0829f1a8aa
Fix security problem, local root exploit. It is no need to install poppassd as setuid. Noted on bugtraq mailing list. http://www.securityfocus.com/archive/1/319811/2003-04-26/2003-05-02/0
22 lines
731 B
Text
22 lines
731 B
Text
$NetBSD: patch-ab,v 1.4 2003/04/29 14:22:46 taca Exp $
|
|
|
|
--- password/Makefile.in.orig Fri Apr 5 04:38:33 2002
|
|
+++ password/Makefile.in Thu May 2 14:22:07 2002
|
|
@@ -30,7 +30,7 @@
|
|
VPATH = @srcdir@
|
|
prefix = @prefix@
|
|
exec_prefix = @exec_prefix@
|
|
-installdir = @bindir@
|
|
+installdir = @libexecdir@
|
|
|
|
common_srcdir = ${top_srcdir}/common
|
|
popper_srcdir = ${top_srcdir}/popper
|
|
@@ -80,7 +80,7 @@
|
|
all: ${poppassd}
|
|
|
|
install:
|
|
- ${INSTALL} -m 4755 -o root -g 0 poppassd ${installdir}/poppassd; \
|
|
+ ${INSTALL} -m 555 -o ${ROOT_USER} -g ${ROOT_GROUP} poppassd ${installdir}/poppassd; \
|
|
echo "Installed poppassd as ${installdir}/poppassd"
|
|
|
|
poppassd: ${OBJS} ${common_dir}/libcommon.a
|