Slackware: fdmount vulnerability
May 25, 2000
A buffer overflow condition exists with fdmount on Slackware.
Summary
Where Find New Packages
MD5 Signatures
Severity
fdmount vulnerability ---------------------
The fdmount program shipped with Slackware has been shown to be vulnerable to a buffer overflow exploit. A user must be in the "floppy" group to execute fdmount, but because fdmount is suid root this is a security problem.
A patched fdmount which replaces the offending sprintf() call with a vsnprintf() (thus closing the hole and eliminating the security risk) has been posted in an updated floppy.tgz package in Slackware-current. Please download the new floppy.tgz and run upgradepkg on it.
Installation Instructions
