Date: Mon, 12 Mar 2001 14:57:54 -0800 From: Brooks Davis <brooks@one-eyed-alien.net> To: Alex Popa <razor@ldc.ro> Cc: security@freebsd.org Subject: Re: 4.3-BETA, sshd.core found in root directory. Message-ID: <20010312145754.A489@Odin.AC.HMC.Edu> In-Reply-To: <20010313004813.A78221@ldc.ro>; from razor@ldc.ro on Tue, Mar 13, 2001 at 12:48:13AM %2B0200 References: <20010313004813.A78221@ldc.ro>
next in thread | previous in thread | raw e-mail | index | archive | help
--DocE+STaALJfprDB Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Mar 13, 2001 at 12:48:13AM +0200, Alex Popa wrote: > I am not really sure what this means (could mean a lot of things,=20 > including bad memory on my machine), but here are the facts: This reminds me of something I noticed during the last discussion of ssh I got involved in and compleatly forgot about. If you create an account with a bad shell (say, /bin/false) and run the following command you get an immediate sshd core dump: ssh -t xxx@localhost /bin/sh Attempting to run gdb on the core appears to show that I'm in: #0 0x4817c3b7 in login_getpwclass () from /usr/lib/libutil.so.3 but the binary is stripped so I don't know and my /usr/obj is out of sync with my world at the moment so I figure running gdb against the unstripped binary is not productive. -- Brooks --=20 Any statement of the form "X is the one, true Y" is FALSE. PGP fingerprint 655D 519C 26A7 82E7 2529 9BF0 5D8E 8BE9 F238 1AD4 --DocE+STaALJfprDB Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE6rVRxXY6L6fI4GtQRAg+kAJ4vCmuI9LwU1SYhc+P4giz+WKJhQQCguZSX NyC1bmupNaEBEMJH1y4nmB8= =akX/ -----END PGP SIGNATURE----- --DocE+STaALJfprDB-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010312145754.A489>