[2708] in bugtraq
Re: Strange changes - any ideas?
daemon@ATHENA.MIT.EDU (Andrew V. Kovalev)
Mon Jun 10 02:59:56 1996
Date: Mon, 10 Jun 1996 10:33:57 +0400
Reply-To: Bugtraq List <BUGTRAQ@NETSPACE.ORG>
From: "Andrew V. Kovalev" <Andrew.V.Kovalev@jet.msk.su>
To: Multiple recipients of list BUGTRAQ <BUGTRAQ@NETSPACE.ORG>
In-Reply-To: <9606081347.AA08459@all.net> from Fred Cohen at "Jun 8,
96 09:47:48 am"
Fred Cohen wrote:
> We run a change-controlled environment, which means that we should be
> aware of all changes. To crosscheck this, we regularly do automated
> change detection. This morning, I made some minor changes to some user
> areas and ran the change control checks only to find the changes listed
> below. (Here are some select extracts)
>
> *** '/bin/newgrp' has changed as follows:
> The contents (md5 checksum) changed. Any change in content can trigger this.
> Checking /bin
> *** '/bin/newgrp' has changed as follows:
> The contents (md5 checksum) changed. Any change in content can trigger this.
> *** '/bin/login' has changed as follows:
Looks like /usr was remounted with nosuid option. All (and only) setuid
executables are listed.
avk
