From owner-freebsd-security  Sun Aug 10 07:47:21 1997
Return-Path: <owner-freebsd-security>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id HAA23820
          for security-outgoing; Sun, 10 Aug 1997 07:47:21 -0700 (PDT)
Received: from netrail.net (netrail.net [205.215.10.3])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id HAA23815
          for <freebsd-security@FreeBSD.ORG>; Sun, 10 Aug 1997 07:47:17 -0700 (PDT)
Received: from localhost (jonz@localhost)
	by netrail.net (8.8.6/8.8.6) with SMTP id KAA14928;
	Sun, 10 Aug 1997 10:46:36 GMT
Date: Sun, 10 Aug 1997 10:46:35 +0000 (GMT)
From: "Jonathan A. Zdziarski" <jonz@netrail.net>
To: Brian Mitchell <brian@firehouse.net>
cc: bugtraq@netspace.org, freebsd-security@FreeBSD.ORG
Subject: Re: procfs hole
In-Reply-To: <Pine.NEB.3.96.970810052824.3287A-100000@apocalypse.saturn.net>
Message-ID: <Pine.BSF.3.95q.970810104520.14828A-100000@netrail.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

never mind about my last message - I was finally able to get it to work on
both 2.2.2 and 2.2.1 systems.  ack.  is the 'su' command the only
pheasable method of manipulating this problem, or do you think it could be
done with other setuid programs?  I'm running sudo, and can disable su,
but then again what if sudo can be modified.


-------------------------------------------------------------------------
Jonathan A. Zdziarski                                NetRail Incorporated
Server Engineering Manager                    230 Peachtree St. Suite 500
jonz@netrail.net                                        Atlanta, GA 30303
http://www.netrail.net                                    (888) - NETRAIL
-------------------------------------------------------------------------