From owner-freebsd-security Mon Jul 1 6:57:23 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5C79C37B400 for ; Mon, 1 Jul 2002 06:57:21 -0700 (PDT) Received: from norton.palomine.net (dsl254-102-179.nyc1.dsl.speakeasy.net [216.254.102.179]) by mx1.FreeBSD.org (Postfix) with SMTP id 6C54F43E09 for ; Mon, 1 Jul 2002 06:57:20 -0700 (PDT) (envelope-from cjohnson@palomine.net) Received: (qmail 65808 invoked by uid 1000); 1 Jul 2002 13:57:19 -0000 Date: Mon, 1 Jul 2002 09:57:19 -0400 From: Chris Johnson To: Dag-Erling Smorgrav Cc: security@freebsd.org Subject: Re: security risk: ktrace(2) in FreeBSD prior to -current. Message-ID: <20020701135719.GA65770@palomine.net> References: <200206301817.EAA05639@caligula.anu.edu.au> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4i Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Mon, Jul 01, 2002 at 03:23:59PM +0200, Dag-Erling Smorgrav wrote: > Darren Reed writes: > > With OpenSSH 3.4, ssh-keysign gets installed setuid-root. > > Not in FreeBSD. Are you sure? ===> Registering installation for openssh-portable-3.4p1_2 ===> SECURITY NOTE: This port has installed the following binaries which execute with increased privileges. 95440 296 -rws--x--x 1 root wheel 150996 Jul 1 09:54 /usr/local/libexec/ssh-keysign Chris Johnson To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message