Re: [Groff] Insecurity

[Werner LEMBERG]

> In a previous mail, I mentioned an article on man-insecurities in
> Linux- Magazin.  I searched www.altavista.com for the name `Pawel
> Wilk' mentioned inthe article and found mayn interesting troff
> discussions in mail archives.
> 
> Moreover, the link
> 
> http://mirror.viii-lo.krakow.pl/bugs/security/bugs/mUNIXes/groff.html
> 
> describes how to install a trojan horse together with a corrupted
> man page.  This could be easily prohibited by checksums, but for
> non-distribution files the danger remains.

With the next groff release this will be no longer possible because
the -S option of groff is now default, disabling .opena, .sy, .pso,
and friends.


    Werner