Re: Possible SunOS 5.5.1 sulogin vulnerability

>Possible hole in sulogin here? Under Solaris 2.5.1 (sparc & x86),
>executing /sbin/sulogin from an unprivileged user account dumps you
>into what appears to be single-user mode with an ugly warning message
>without prompting for the root password. You don't find this with
>earlier versions of Solaris (2.5 and lower).

It's a Bourne shell; the only difference with a regular /sbin/sh
invocation is that it prints:

                *** NO ENTRY FOR root IN PASSWORD FILE! ***

                Entering System Maintenance Mode

before starting the shell.

And that's because you're not root.

The difference between 2.5- and 2.5.1 is that the set-uid bit, which
is non-sensical for programs that are supposed to be only started by root
anyway, was dropped.

Casper
Received on Nov 15 1996