From owner-freebsd-security Wed Oct 4 10:32:49 2000 Delivered-To: freebsd-security@freebsd.org Received: from rover.village.org (rover.village.org [204.144.255.49]) by hub.freebsd.org (Postfix) with ESMTP id 3F65837B503 for ; Wed, 4 Oct 2000 10:32:46 -0700 (PDT) Received: from harmony.village.org (harmony.village.org [10.0.0.6]) by rover.village.org (8.11.0/8.11.0) with ESMTP id e94HWhM16374; Wed, 4 Oct 2000 11:32:43 -0600 (MDT) (envelope-from imp@harmony.village.org) Received: from harmony.village.org (localhost.village.org [127.0.0.1]) by harmony.village.org (8.9.3/8.8.3) with ESMTP id LAA37782; Wed, 4 Oct 2000 11:32:43 -0600 (MDT) Message-Id: <200010041732.LAA37782@harmony.village.org> To: "John" Subject: Re: Fwd: BSD chpass Cc: "Mike Tancsa" , freebsd-security@FreeBSD.ORG In-reply-to: Your message of "Wed, 04 Oct 2000 13:15:55 EDT." <008001c02e26$c20c6100$03030303@dns> References: <008001c02e26$c20c6100$03030303@dns> <4.2.2.20001004011210.035225e0@mail.sentex.net> <200010041719.LAA37604@harmony.village.org> Date: Wed, 04 Oct 2000 11:32:43 -0600 From: Warner Losh Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org In message <008001c02e26$c20c6100$03030303@dns> "John" writes: : chmod a-s /usr/bin/chpass : or chmod 700 /usr/bin/chpass : : Solution or not ? I believe that will work out just fine. workaround. It will protect you from the exploit, but much functionality that these commands provide will be lost. Warner To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message