On Fri, Sep 10, 2004 at 01:30:17AM -0000, newbug Tseng wrote: > > > #!/bin/bash > > echo "cdr-exp.sh -- CDRecord local exploit ( Tested on > cdrecord-2.01-0.a27.2mdk + Mandrake10)" > echo "Author : newbug [at] chroot.org" > echo "IRC : irc.chroot.org #chroot" > echo "Date :09.09.2004" I don't see how this is a bug in cdrecord. It's a bug in Mandrake, caused by shipping cdrecord setuid root. You could do the same thing with CVS (set CVS_RSH to /tmp/s) if your distribution was dumb enough to ship cvs setuid root, I would think, yet that wouldn't be a bug in CVS. -Sean -- /~\ The ASCII \ / Ribbon Campaign Sean Davis X Against HTML aka dive / \ Email!
Attachment:
pgpKfgAk8BM9Y.pgp
Description: PGP signature