I'm...mildly impressed. Someone's still *using* that thing? Not that things have changed in this regard, but the latest version is 1.1.9, anyway. Serious question, actually - they shouldn't exist, I know (believe me, I don't still code like that...), but exactly how severe is a hole such as this, which is only exploitable by the user who is running the daemon in the first place? Unless you're doing something like running the daemon as root, with a user-modifiable config file (at which point you have much more serious problems, like CGI), this doesn't actually escalate someone's privilege at all. On Tuesday 11 May 2004 21:19, Anonymous wrote: > Solution: > > fluffy has written a great cmd line hack to solve the problem: > > for i in `locate surfboard`; do rm -rf $i ; done > > Should do the trick ;) Unfortunately, fluffy has neglected the file actually responsible, /usr/local/bin/surfd. Sorry to break it to him/her/it :^) fluffy also forgot the next line, which goes something along the lines of: apt-get install apache Seriously. You shouldn't be using this lump of junk. Anyway, you *definitely* shouldn't be using 1.1.6, cause there's a good couple of arbitrary-traversal holes in there, along with tons of bugs (something you'd know if you read the archives of this list). 1.1.9 was the latest at time of announcement, and v1.1.10 is now on the sourceforge site, for any fool who's still using it... Meredydd
