vulnerability in su?
    kirt 
    krs at gaultopia.org
       
    Sat Nov  8 17:23:27 PST 2003
    
    
  
while recently cvsup'ing my box here at home, i had a weird thing happen...
i had already built world, built and installed the kernel, installed world (including all 
appropriate reboots), and when i brought it back up, but prior to running mergemaster, i 
popped the jumper on the circuit the box is on.  my ups is somewhat wimpy, and only lasts 
a couple minutes (the fuse trips all the time too.. stupid apartment wiring can't handle 
2 computers and the washer and dryer at once =P ) so i made it a priority to go ahead and 
shut the box down.  after fixing said jumper and bring the box back up i noticed that i 
could now su like a madman, without ever being prompted for passwords.  i then remembered 
that i hadn't run mergemaster yet, so i ran it again and rebooted for safe measure and su 
started asking for passwords again.
is this a known issue?  i didn't search to hard for a fix or anything since i quickly 
fixed it myself, but i thought that a situation like that could make for some interesting 
(read *bad*) situations.
-kirt
    
    
More information about the freebsd-questions
mailing list