Warning! /usr/bin/uudecode creates setuid files!

[Justin Glass]

I'm running cops on a hp workstation and receiving the following error:

Warning! /usr/bin/uudecode creates setuid files!

How do I fix this error in the cops report?

[Alex Glennie]

I have heard of this sometime ago so the question I guess is what version of uuencode (what output) and what O/S.

As I understand things this was cleared up in 10.10 / uudecode version 76.1 ....

[doug hosking]

My opinion is to mostly ignore it. This is only a problem if a privileged user blindly runs uudecode on something like a mail attachment without looking at the file to be decoded first. That's not a good idea for uuencoded files, shar archives, shell scripts, or any other file, for the same reasons you shouldn't blindly execute mail attachments on a PC.

uudecode itself is an unprivileged binary, so there is not any special risk to it. Check your mail aliases file to make sure there is not a uudecode alias in that.

Patch PHCO_8965 claims to fix this on older HP-UX releases.

[doug hosking]

My opinion is to mostly ignore it. This is only a problem if a privileged user blindly runs uudecode on something like a mail attachment without looking at the file to be decoded first. That's not a good idea for uuencoded files, shar archives, shell scripts, or any other file, for the same reasons you shouldn't blindly execute mail attachments on a PC.

uudecode itself is an unprivileged binary, so there is not any special risk to it. Check your mail aliases file to make sure there is not a uudecode alias in that.

Patch PHCO_8965 claims to fix this on older HP-UX releases.