Security Alert: Development Tools
"Dittmar, Daniel" <[email protected]> Tue, 22 Apr 2003 17:53:50 +0200
| Newsgroups | gmane.comp.db.sapdb.sources |
|---|---|
| Message-ID | <B9A2DDA03044D311BBD40008C75D6968147D8643@dewdfx24> |
The SAP DB development tools contain two programs that make it very easy to run arbitrary programs as user root: $TOOL/bin/instdbmsrv and $TOOL/bin/instlserver. Please replace these programs with empty shell scripts. This applies to Linux/Unix platforms. Consequences: - the programs dbmsrv and lserver (used by the DB Manager and Loader respectively) are no longer automatically changed to suid root programs during the build - it is either necessary to set the suid bit by hand - or to start the x_server as a specific user and to create databases only as that user Daniel Dittmar -- Daniel Dittmar SAP DB, SAP Labs Berlin [email protected] http://www.sapdb.org/