(none)

• Messages sorted by: [ date ][ thread ][ subject ][ author ]
• Next message: jlacour@merle.acns.nwu.edu: "Re: /etc/utmp"
• Previous message: Stan Barber: "Re: NFS problems"
• In reply to: Aleph One: "utmp"
• Next in thread: jlacour@merle.acns.nwu.edu: "Re: /etc/utmp"

>Hmm, anyone can explain a bit more the recent CERT advisory on /etc/utmp.
>I assume the attakers where able to obtain root by fooling programms that
>only use the information in /etc/utmp for authentication, instead of
>calling for the users user id  and real user id. anyone mind extending
>this description...


Some programs will write directly to "devices" found in /etc/utmp,
without validating that they are really user's tty devices.

	-Jeff
-- 
Jeff Beadles       jeff@neon.rain.com

• Next message: jlacour@merle.acns.nwu.edu: "Re: /etc/utmp"
• Previous message: Stan Barber: "Re: NFS problems"
• In reply to: Aleph One: "utmp"
• Next in thread: jlacour@merle.acns.nwu.edu: "Re: /etc/utmp"