From owner-freebsd-security  Fri Aug 21 00:47:45 1998
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id AAA28178
          for freebsd-security-outgoing; Fri, 21 Aug 1998 00:47:45 -0700 (PDT)
          (envelope-from owner-freebsd-security@FreeBSD.ORG)
Received: from lariat.lariat.org (lariat.lariat.org [206.100.185.2])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id AAA28170
          for <security@FreeBSD.ORG>; Fri, 21 Aug 1998 00:47:43 -0700 (PDT)
          (envelope-from brett@lariat.org)
Received: (from brett@localhost)
	by lariat.lariat.org (8.8.8/8.8.6) id BAA09394;
	Fri, 21 Aug 1998 01:46:59 -0600 (MDT)
Message-Id: <199808210746.BAA09394@lariat.lariat.org>
X-Sender: brett@mail.lariat.org
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.1.0.44 (Beta)
Date: Fri, 21 Aug 1998 01:46:58 -0600
To: "Jordan K. Hubbard" <jkh@time.cdrom.com>, security@FreeBSD.ORG
From: Brett Glass <brett@lariat.org>
Subject: Re: Scaring the bezeesus out of your system admin as a normal
  user:
In-Reply-To: <29367.903682974@time.cdrom.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Not to mention what you can do if you feed it an absurdly long
string in some UNIX implementations. (Oops, just mentioned it.)

--Brett

At 12:02 AM 8/21/98 -0700, Jordan K. Hubbard wrote:
 
>% logger -p auth.notice -t su crackman to root on ttyp1
>
>I'd suggest that /var/run/log should have 0600 permissions but that
>would certainly screw over a few of syslog(3)'s current users.
>
>Hmmmm.  No quick ideas here. :)
>
>- Jordan
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe freebsd-security" in the body of the message
> 

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message