From owner-freebsd-questions@FreeBSD.ORG  Sun Nov  9 03:28:11 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2A3EF16A4CE
	for <freebsd-questions@freebsd.org>;
	Sun,  9 Nov 2003 03:28:11 -0800 (PST)
Received: from obsecurity.dyndns.org
	(adsl-63-207-60-234.dsl.lsan03.pacbell.net [63.207.60.234])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6AD2443FBF
	for <freebsd-questions@freebsd.org>;
	Sun,  9 Nov 2003 03:28:09 -0800 (PST)
	(envelope-from kris@obsecurity.org)
Received: by obsecurity.dyndns.org (Postfix, from userid 1000)
	id D1DBC66B28; Sun,  9 Nov 2003 03:28:08 -0800 (PST)
Date: Sun, 9 Nov 2003 03:28:08 -0800
From: Kris Kennaway <kris@obsecurity.org>
To: kirt <krs@gaultopia.org>
Message-ID: <20031109112808.GA94834@xor.obsecurity.org>
References: <20031109012325.GD829@yttrium.gaultopia.org>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="UlVJffcvxoiEqYs2"
Content-Disposition: inline
In-Reply-To: <20031109012325.GD829@yttrium.gaultopia.org>
User-Agent: Mutt/1.4.1i
cc: freebsd-questions@freebsd.org
Subject: Re: vulnerability in su?
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 09 Nov 2003 11:28:11 -0000


--UlVJffcvxoiEqYs2
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Nov 08, 2003 at 08:23:25PM -0500, kirt wrote:

> is this a known issue?  i didn't search to hard for a fix or anything sin=
ce i quickly=20
> fixed it myself, but i thought that a situation like that could make for =
some interesting=20
> (read *bad*) situations.

It's certainly possible to compromise your system in this way if you
incorrectly update your /etc (e.g. by making a mistake with mergemaster).

Kris

--UlVJffcvxoiEqYs2
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (FreeBSD)

iD8DBQE/riTIWry0BWjoQKURApy4AKCo5f1uccuLnLjy4rpCsmw7xCpmtwCg1Y1E
Ei9Y8i5NV0ZyUc46Vw5Kues=
=zVqx
-----END PGP SIGNATURE-----

--UlVJffcvxoiEqYs2--