From owner-freebsd-security Tue Oct 15 09:11:50 1996 Return-Path: owner-security Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id JAA16438 for security-outgoing; Tue, 15 Oct 1996 09:11:50 -0700 (PDT) Received: from gvr.win.tue.nl (root@gvr.win.tue.nl [131.155.210.19]) by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id JAA16391 for ; Tue, 15 Oct 1996 09:11:39 -0700 (PDT) Received: by gvr.win.tue.nl (8.6.13/1.53) id SAA04691; Tue, 15 Oct 1996 18:09:59 +0200 From: guido@gvr.win.tue.nl (Guido van Rooij) Message-Id: <199610151609.SAA04691@gvr.win.tue.nl> Subject: Re: bin/1805: Bug in ftpd To: assar@sics.se (Assar Westerlund) Date: Tue, 15 Oct 1996 18:09:59 +0200 (MET DST) Cc: marcs@znep.com, freebsd-security@FreeBSD.org In-Reply-To: <5lvicd6ufk.fsf@assaris.sics.se> from Assar Westerlund at "Oct 15, 96 00:40:46 am" X-Mailer: ELM [version 2.4ME+ PL17 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-security@FreeBSD.org X-Loop: FreeBSD.org Precedence: bulk > > After the setuid, I will be able to make it dump core, or even better > use `ptrace' and then login will still have the file descriptor > pointing to /etc/spwd.db open and I can make it read the complete > shadow file. endpwent closes the spwd.db if I'm right so that would be impossible. -Guido