[2215] in Kerberos-V5-bugs
Re: security hole in v4 and v5 login?
daemon@ATHENA.MIT.EDU (schemers@stanford.edu)
Tue Sep 10 16:53:16 1996
Date: Tue, 10 Sep 1996 13:52:54 -0700 (PDT)
From: schemers@stanford.edu
To: "Barry Jaspan" <bjaspan@MIT.EDU>
Cc: Sam Hartman <hartmans@MIT.EDU>, schemers@stanford.edu, krb5-bugs@MIT.EDU
In-Reply-To: <9609101522.AA15372@DUN-DUN-NOODLES.MIT.EDU>
Barry Jaspan writes:
>
> Ted and I discussed this yesterday, realized that the problem does not
> exist if the sticky bit is set on /tmp, but decided that we should fix
> it because it could be *perceived* as a Unix security hole in
> Kerberos. The solution we decided on is:
>
> do normal as-root login stuff
> read creds from root-owned ccache into memory
> destroy ccache
> setuid(user)
> re-create ccache as user, write credds into it
> do normal as-user login stuff
>
thanks. Sounds like a good idea to me.
roland
