[812] in Info-AFS_Redistribution
LD_ bug in /bin/login
daemon@ATHENA.MIT.EDU (Brian Fitzgerald)
Sat May 30 20:09:01 1992
From: fitzgb@mml0.meche.rpi.edu (Brian Fitzgerald)
Date: Sat, 30 May 1992 22:45:13 GMT
Apparently-To: rpi-mail-afs
Just the minor comment about AFS /bin/login that it contains the same
LD_LIBRARY_PATH hole that Sun just fixed. A minor security hole, but
worth patching.
Brian
(The hole lets a user get a shell in a no-password account (i.e. user
"sync"), even if the login shell is intended to be a non-interactive
program (i.e. /bin/sync). The bug has been discussed on usenet, and
source code that gives the basic idea of how to fix it is in the recent
CERT bulletin. Wietse Venema (wietse@wzv.win.tue.nl) wrote the patch.)
... just an afs user. I don't work for ITS. These are my opinions.
