su to root denied?

[Paul Schmehl]

--On December 6, 2006 9:42:41 PM -0500 Kris Kennaway <kris at obsecurity.org> 
wrote:

> On Wed, Dec 06, 2006 at 07:52:50PM -0600, john Mish III wrote:
>> I get this error message when I try to su to anything, either from root
>> or  to root, and I don't know why.
>> $ su
>> su: not running setuid
>
> Somehow your su application lost its setuid bit.  Instead of blinding
> chmodding it you may want to be careful and replace it with a known
> good binary in case someone overwrote it somehow.
>
Or he's been hacked, and he needs to proceed very cautiously....

Paul Schmehl (pauls at utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/