From owner-freebsd-security Wed Aug 5 22:16:06 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id WAA29177 for freebsd-security-outgoing; Wed, 5 Aug 1998 22:16:06 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from mew.gol.com (mew.gol.com [203.216.0.88]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id WAA29158 for ; Wed, 5 Aug 1998 22:16:01 -0700 (PDT) (envelope-from jun@mew.gol.com) Received: (from jun@localhost) by mew.gol.com (8.9.0/8.9.0) id OAA01977; Thu, 6 Aug 1998 14:15:41 +0900 (JST) To: FreeBSD-security@FreeBSD.ORG Subject: Re: Does this mean we have another breakin? References: <199808051643.KAA04281@lariat.lariat.org> <19980805234700.A23220@keltia.freenix.fr> Mime-Version: 1.0 (generated by tm-edit 7.108) Content-Type: text/plain; charset=US-ASCII From: Just Another Perl Hacker Date: 06 Aug 1998 14:15:41 +0900 In-Reply-To: Ollivier Robert's message of "Wed, 5 Aug 1998 23:47:00 +0200" Message-ID: Lines: 24 X-Mailer: Gnus v5.6.24/XEmacs 20.4 - "Emerald" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >>>>> "O" == Ollivier Robert writes: O> According to Brett Glass: >> setuid diffs: >> 9c9 >> < -r-xr-sr-x 2 root tty 225280 Jul 22 02:13:13 1998 >> /sbin/restore >> --- >> > -r-xr-sr-x 2 root tty 225280 Aug 4 15:00:14 1998 >> /sbin/restore O> Verify, if you have them, the MD5 checksums. If they don't have O> changed, you've been hit by a VM bug where mod. time is changed O> even if the executable has only been loaded. Is this bug send-pr(1)'d yet? I tried the GNATS database of FreeBSD web page, to no avail. If you or anyone on the list have a pointer to the problem, please let me know. Thank you in advance. -- Junichi Kurokawa Global Online Japan Corporation, Tokyo To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message