Date: Mon, 23 Oct 1995 00:39:26 +0300 (MSK) From: =?KOI8-R?Q?=E1=CE=C4=D2=C5=CA_=FE=C5=D2=CE=CF=D7?= (aka Andrey A. Chernov, Black Mage) <ache@astral.msk.su> To: "Justin T. Gibbs" <gibbs@freefall.freebsd.org> Cc: CVS-commiters@freefall.freebsd.org, "Andrey A. Chernov" <ache@freefall.freebsd.org>, cvs-user@freefall.freebsd.org Subject: Re: cvs commit: src/secure/libexec/telnetd sys_term.c Message-ID: <aBEehYmW2q@ache.dialup.demos.ru> In-Reply-To: <199510222126.OAA17661@aslan.cdrom.com>; from "Justin T. Gibbs" at Sun, 22 Oct 1995 14:26:42 -0700 References: <199510222126.OAA17661@aslan.cdrom.com>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <199510222126.OAA17661@aslan.cdrom.com> Justin T. Gibbs
writes:
>Perhaps we should mention it to the author. Don't we also have a security
>problem in login since it is shared? I would expect any user logged into
>your system to be able to become any other user by using their own crypt
>library. Its not like our library sources aren't availible. :)
All suid programs unsetenv this LD_* cruft in rtld.
It isn't so only for programs started with same uid as suid,
i.e. root telnetd starts root login.
It seems that telnetd is only one who provide whole user
environment passing, but I isn't 100% shure.
--
Andrey A. Chernov : And I rest so composedly, /Now, in my bed,
ache@astral.msk.su : That any beholder /Might fancy me dead -
http://dt.demos.su/~ache : Might start at beholding me, /Thinking me dead.
RELCOM Team,FreeBSD Team : E.A.Poe From "For Annie" 1849
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?aBEehYmW2q>