A post on Bugtraq (<20020917183024.GA7393@yakuza.salon.cz>) brought up a
somewhat minor flaw in the JOE editor. Backups of sgid/suid files should
drop the sgid/suid bits, because backup files are owned by the user running
joe, not the owner of the file.
Fix: Add patch-ak to ports/editors/files:
Create a file such as this:
-rwsr-sr-x 1 toasty toasty 2 Sep 18 02:00 test.file
As root, open/save it, and this backup file is created:
-rwsr-sr-x 1 root wheel 2 Sep 18 01:58 test.file~
It would require some impressive social engineering to take advantage of
this, but it's still not a good idea.