Date: 06 Aug 1998 14:15:41 +0900 From: Just Another Perl Hacker <japh@gol.com> To: FreeBSD-security@FreeBSD.ORG Subject: Re: Does this mean we have another breakin? Message-ID: <o90l2bshu.fsf@mew.gol.com> In-Reply-To: Ollivier Robert's message of "Wed, 5 Aug 1998 23:47:00 %2B0200" References: <199808051643.KAA04281@lariat.lariat.org> <19980805234700.A23220@keltia.freenix.fr>
next in thread | previous in thread | raw e-mail | index | archive | help
>>>>> "O" == Ollivier Robert <roberto@keltia.freenix.fr> writes:
O> According to Brett Glass:
>> setuid diffs:
>> 9c9
>> < -r-xr-sr-x 2 root tty 225280 Jul 22 02:13:13 1998
>> /sbin/restore
>> ---
>> > -r-xr-sr-x 2 root tty 225280 Aug 4 15:00:14 1998
>> /sbin/restore
O> Verify, if you have them, the MD5 checksums. If they don't have
O> changed, you've been hit by a VM bug where mod. time is changed
O> even if the executable has only been loaded.
Is this bug send-pr(1)'d yet? I tried the GNATS database of FreeBSD
web page, to no avail.
If you or anyone on the list have a pointer to the problem, please let
me know. Thank you in advance.
--
Junichi Kurokawa <japh@gol.com>
Global Online Japan Corporation, Tokyo
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?o90l2bshu.fsf>