> On Thu, 27 Nov 2003, Timo Sirainen wrote:
>
> > Buffer overflow in GNU screen allows privilege escalation for local users.
> > Usually screen is installed either setgid-utmp or setuid-root.
> >
> With devpts and libutempter it is possible to install fully functional
> screen without suid/sgid.
Does that mean any program that links with libutempter gains
complete suid/sgid root functionality, or only when executing
the functions in the libutempter library, please?
> On Thu, 27 Nov 2003, Timo Sirainen wrote:
>
> > Buffer overflow in GNU screen allows privilege escalation for local users.
> > Usually screen is installed either setgid-utmp or setuid-root.
> >
> With devpts and libutempter it is possible to install fully functional
> screen without suid/sgid.
Does that mean any program that links with libutempter gains
complete suid/sgid root functionality, or only when executing
the functions in the libutempter library, please?
[ reply ]