A post on Bugtraq (<20020917183024.GA7393@yakuza.salon.cz>) brought up a somewhat minor flaw in the JOE editor. Backups of sgid/suid files should drop the sgid/suid bits, because backup files are owned by the user running joe, not the owner of the file. Fix: Add patch-ak to ports/editors/files: How-To-Repeat: Create a file such as this: -rwsr-sr-x 1 toasty toasty 2 Sep 18 02:00 test.file As root, open/save it, and this backup file is created: -rwsr-sr-x 1 root wheel 2 Sep 18 01:58 test.file~ It would require some impressive social engineering to take advantage of this, but it's still not a good idea.
State Changed From-To: open->closed committed, thanks