Bug 41912

Summary:	/usr/cyrus/bin/deliver-wrapper is cyrus writable
Product:	[Retired] Red Hat Powertools	Reporter:	Jarno Huuskonen <jarno.huuskonen>
Component:	cyrus-imapd	Assignee:	Nalin Dahyabhai <nalin>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.1	CC:	rm0
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2003-02-12 11:12:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jarno Huuskonen 2001-05-22 20:49:28 UTC

Description of Problem:
(rawhide powertools cyrus-imapd-2.0.9-3)
cyrus:mail owns /usr/cyrus/bin/deliver-wrapper (and the
program is setgid). Why is the program owned(writable) by cyrus ? If
somebody can get user cyrus permissions they can modify the program -->
possibility to gain more privileges.

(I haven't fully investigated the issue and apologize if this is a non
issue).

Comment 1 Mark J. Cox 2003-02-12 11:12:42 UTC

Closing, Power Tools no longer supported.