Subject: Re: CRITICAL ** Holes in default cron jobs ** CRITICAL
To: Michael Richardson <mcr@sandelman.ottawa.on.ca>
From: Giles Lean <giles@nemeton.com.au>
List: current-users
Date: 12/30/1996 07:49:33
On Sun, 29 Dec 1996 13:47:05 -0500  Michael Richardson wrote:

> >(find / ! -fstype local -a -prune -o \
> >    \( -perm -u+s -o -perm -g+s -o ! -type d -a ! -type f -a ! -type l -a \
> >       ! -type s \) | \
> >sort | sed -e 's/^/ls -ldgT /' | sh > $LIST) 2> $OUTPUT
> 
>   Uh, isn't this missing a -print *anyway* ???
>   I wasn't able to exploit this until I added one.

Find adds -print automatically; exploiting it worked just fine.

OpenBSD has added -print0 to find(1) and -0 to xargs(1), based on the
NetBSD versions of find and xargs.  These sources compile cleanly on
NetBSD (at least on 1.1 -- I haven't upgraded to 1.2 yet).

Anyone want a re-written /etc/security that uses these?

Giles