[1333] in linux-security and linux-alert archive
[linux-security] Re: denial of service attack on login
daemon@ATHENA.MIT.EDU (Andrzej K. Brandt)
Thu Nov 28 08:08:00 1996
Date: Thu, 28 Nov 1996 11:41:47 +0100 (MET)
From: "Andrzej K. Brandt" <andy@mimuw.edu.pl>
To: Linux Security <linux-security@redhat.com>
In-Reply-To: <199611261549.HAA16832@parc.power.net>
Resent-From: linux-security@redhat.com
Reply-To: linux-security@redhat.com
On Tue, 26 Nov 1996, Andrew G. Morgan wrote:
> The following denial of service attack seems to work quite nicely on my
> ancient Red Hat 3.0.3 system with the standard login application. Perhaps
> this is not a problem with 4.0? Does anyone know about other distributions?
>
> joe$ nvi /var/log/wtmp
>
> [ Now no-one else can log in ]
Doesn't work on RedHat 4.0 on sparc.
[mod: Figures. Andrews introduction mentioned that he was looking at
old code for the implementation of the PAM project. So you'd guess
that they wouldn't make the same mistake there as in the "old"
code.... (PAM is included in Red Hat 4.0) -- REW]
--
/-------------------+--------+-------------------+-------------------------\
I Andrzej K. Brandt I SP5WCA I andy@mimuw.edu.pl I andy@linux.org.pl I
+-------------------+--------+-----+-------------+-------------------------+
| http://melkor.mimuw.edu.pl/~andy | IRC: Emin | PGP key available |
\--------------------------------------------------------------------------/
