From owner-freebsd-security  Sun Feb 25 15:04:26 1996
Return-Path: owner-security
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id PAA26494
          for security-outgoing; Sun, 25 Feb 1996 15:04:26 -0800 (PST)
Received: from anna.az.com (root@anna.az.com [204.57.139.9])
          by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id PAA26489
          for <freebsd-security@freebsd.org>; Sun, 25 Feb 1996 15:04:23 -0800 (PST)
Received: (from yankee@localhost) by anna.az.com (8.6.12/8.6.12) id PAA02149; Sun, 25 Feb 1996 15:06:38 -0800
Date: Sun, 25 Feb 1996 15:06:37 -0800 (PST)
From: "az.com" <yankee@anna.az.com>
To: invalid opcode <coredump@nervosa.com>
cc: Brian Tao <taob@io.org>, FREEBSD-SECURITY-L <freebsd-security@freebsd.org>
Subject: Re: Suspicious symlinks in /tmp
In-Reply-To: <Pine.BSF.3.91.960225131851.8196F-100000@nervosa.com>
Message-ID: <Pine.BSF.3.91.960225150400.1969A-100000@anna.az.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-security@freebsd.org
Precedence: bulk



>From what I understand, the attack involves pointing a symlink to an 
important file in a priveledged area so that the file gets deleted upon 
system startup via the rc's auto /tmp clearing feature.