From owner-freebsd-bugs Sun Jan 28 13:45:18 1996 Return-Path: owner-bugs Received: (from root@localhost) by freefall.freebsd.org (8.7.3/8.7.3) id NAA03170 for bugs-outgoing; Sun, 28 Jan 1996 13:45:18 -0800 (PST) Received: from mpp.minn.net (root@mpp.Minn.Net [204.157.201.242]) by freefall.freebsd.org (8.7.3/8.7.3) with ESMTP id NAA03165 for ; Sun, 28 Jan 1996 13:45:12 -0800 (PST) Received: (from mpp@localhost) by mpp.minn.net (8.7.3/8.6.9) id PAA02088; Sun, 28 Jan 1996 15:44:57 -0600 (CST) Message-Id: <199601282144.PAA02088@mpp.minn.net> Subject: Re: Not Exactly a Bug, but a Crack To: dhawk@netcom.com (David H) Date: Sun, 28 Jan 1996 15:44:57 -0600 (CST) From: "Mike Pritchard" Cc: bugs@freebsd.org In-Reply-To: <199601272046.MAA28965@netcom13.netcom.com> from "David H" at Jan 27, 96 12:46:07 pm X-Mailer: ELM [version 2.4 PL25 ME8b] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-bugs@freebsd.org Precedence: bulk David H wrote: > > On Wednesday, the day before, the security script reported that my > /usr/sbin/sendmail had been replaced. It was still suid-root and now > setgid kmem. My cd-rom drive on the machine is broken, so I haven't > been able to replace it yet. Sendmail is normally installed mode 6555, owner root, group kmem. I have no idea what it needs kmem access for. Your security script probably detected a bug that has been around for some time. For some reason, the modification time of some binaries will get updated, even though the binary never changed in any way. -- Mike Pritchard mpp@minn.net "Go that way. Really fast. If something gets in your way, turn"