Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com

Neohapsis > Archives > Bugtraq> 1994_1

Bugtraq archives for 1st quarter (Jan-Mar) 1994: Re: /etc/utmp

Re: /etc/utmp

chesresearch.att.com
Mon, 28 Mar 94 13:07 EST

Messages sorted by: [ date ][ thread ][ subject ][ author ]
Next message: chesresearch.att.com: "Re: /etc/utmp"
Previous message: Icarus Sparry: "Re: /etc/utmp"
In reply to: Pat Myrto: "Re: /etc/utmp"
Next in thread: chesresearch.att.com: "Re: /etc/utmp"

In <9403252218.AA14294rwing.UUCP>  you write:
  I don't know of a specific patch, for this.  But the only REAL fix is
  to make the /etc/utmp file so it is not world-writeable.  That means,
  of course, fixing anything that must update it, other than login or init
  to run SUID root without creating a worse hole.  

To quote our President: "NO NO NO NO NO NO NO ..." :-)

Making things setuid root is almost always wrong.   Make a new group,
say group "utmp", and make anything that needs to deal with utmp

Next message: chesresearch.att.com: "Re: /etc/utmp"
Previous message: Icarus Sparry: "Re: /etc/utmp"
In reply to: Pat Myrto: "Re: /etc/utmp"
Next in thread: chesresearch.att.com: "Re: /etc/utmp"