[ Search ] [ What's New? ] [ About ]
[ Bugs ] [ Misc ] [ Mailing Lists ] [ Newgroups ] [ NewsWire ] [ Papers ] [ People ]
[ Pictures ] [ Publications ] [ Responce Teams ] [ Tools ] [ Upcoming Events ] [ Web Sites ]

login(M)
Systems Affected: SCO Unix System V/386 Release 3.2 Versions 4.2, 4.1, and 4.0
SCO Open Desktop Lite Release 3.0
SCO Open Desktop Release 3.0 and 2.0
SCO Open Server Network System Release 3.0
SCO Open Server Enterprise System Release 3.0
Problem: /bin/login updates ~/.lastlogin to record the time of the last successful login. Unfortunately the file is opened while /bin/login has root privileges, and no checks are made on the file before it is opened; hence a symlink may be inserted and an arbitrary file created. 

        % rm -f ~/.lastlogin
        % ln -s /etc/8LGMFILE ~/.lastlogin
Logout and login to the system again, and /etc/8LGMFILE will be created. The file will be owned by you, and will be mode 600.
Solution: Contact SCO for a patch. The patch is available at ftp.sco.COM:/SSE/sse002.*

Aleph One / aleph1@underground.org
Copyright © 1996 Computer Underground Society. All rights reserved.