Date: Sun, 10 Aug 1997 14:36:13 -0400 (EDT) From: Brian Mitchell <brian@firehouse.net> To: "Jonathan A. Zdziarski" <jonz@netrail.net> Cc: bugtraq@netspace.org, freebsd-security@FreeBSD.ORG Subject: Re: procfs hole Message-ID: <Pine.BSI.3.95.970810143501.19099B-100000@shell.firehouse.net> In-Reply-To: <Pine.BSF.3.95q.970810104520.14828A-100000@netrail.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, 10 Aug 1997, Jonathan A. Zdziarski wrote: > never mind about my last message - I was finally able to get it to work on > both 2.2.2 and 2.2.1 systems. ack. is the 'su' command the only > pheasable method of manipulating this problem, or do you think it could be > done with other setuid programs? I'm running sudo, and can disable su, > but then again what if sudo can be modified. Don't be silly, any setuid program can be used. If I chose to overwrite printf() with code to setuid and execute a shell, it would prob work with any setuid program. As noted, the easiest way to avoid the problem is just to disable procfs -- nobody really uses it anyways.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSI.3.95.970810143501.19099B-100000>