From owner-freebsd-security  Wed Aug  5 16:28:16 1998
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id QAA14896
          for freebsd-security-outgoing; Wed, 5 Aug 1998 16:28:16 -0700 (PDT)
          (envelope-from owner-freebsd-security@FreeBSD.ORG)
Received: from lariat.lariat.org ([206.100.185.2])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id QAA14816
          for <security@FreeBSD.ORG>; Wed, 5 Aug 1998 16:28:12 -0700 (PDT)
          (envelope-from brett@lariat.org)
Received: (from brett@localhost)
	by lariat.lariat.org (8.8.8/8.8.6) id RAA00806;
	Wed, 5 Aug 1998 17:27:59 -0600 (MDT)
Message-Id: <199808052327.RAA00806@lariat.lariat.org>
X-Sender: brett@mail.lariat.org
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0.1 
Date: Wed, 05 Aug 1998 17:22:15 -0600
To: Ollivier Robert <roberto@keltia.freenix.fr>, security@FreeBSD.ORG
From: Brett Glass <brett@lariat.org>
Subject: Re: Does this mean we have another breakin?
In-Reply-To: <19980805234700.A23220@keltia.freenix.fr>
References: <199808051643.KAA04281@lariat.lariat.org>
 <199808051643.KAA04281@lariat.lariat.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

The MD5's are the same. Must be a VM bug.

Maybe the same one that's crashing us left and right.

--Brett

At 11:47 PM 8/5/98 +0200, Ollivier Robert wrote:
 
>According to Brett Glass:
>> setuid diffs:
>> 9c9
>> < -r-xr-sr-x  2 root  tty       225280 Jul 22 02:13:13 1998 /sbin/restore
>> ---
>> > -r-xr-sr-x  2 root  tty       225280 Aug  4 15:00:14 1998 /sbin/restore
>
>Verify, if you have them, the MD5 checksums. If they don't have changed,
>you've been hit by a VM bug where mod. time is changed even if the
>executable has only been loaded.
>-- 
>Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=-
roberto@keltia.freenix.fr
>FreeBSD keltia.freenix.fr 3.0-CURRENT #62: Mon Jul 27 20:47:08 CEST 1998
>
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe security" in the body of the message
> 

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe security" in the body of the message