On Tue, 19 Jun 2001, Jan-Frode Myklebust wrote:
> On Tue, Jun 19, 2001 at 08:17:03AM +0200, Michal Kara wrote:
> > I guess this is of a high importance for people on this list... If you
> > don't
> > need pmpost suided, just remove the suid bit and it'll be fine.
> >
>
> I just verified this on IRIX (not the opensource
> pcp), which also is vulnerable. Could somebody at
> sgi tell us the consequence of removing the suid
> bit here?
>
As Michal said, the fix is to remove the suid bit.
The only consequence is that the PCP "NOTICES" file
(/var/log/pcp/NOTICES on linux, and /var/adm/pcplog/NOTICES
on IRIX) will not be created if it doesn't exist. This
should only affect a new installation, so you would have
to create this file by hand.
We'll have a new PCP RPM as soon as we can. For IRIX, a patch
may be necessary.
-- Mark Goodwin
SGI Engineering
|