Re: bin owned system files

[beren () cosmos kaist ac kr (Jungseok Roh)]

> In Solaris 2.x, many of the system files
> and directories are distributed with
> the owner as "bin" and the group as
> "bin".
>
> Many security publications warn against
> "root" executables that are not owned
> by "root".
>
> Are there any known problems/bugs/etc.
> with "root" executing system binaries
> owned by "bin" as long as the "bin"
> account is disabled in /etc/passwd.
> (i.e. * for password and /bin/false
> for the shell).
>
> Thanks,
> bob

   hm..Solaris 2.4 has fatal drawbacks in CORE dump.
   if directory is group writable.. ex. /etc is owned by sys.
   then using Setgid utilities .. we can write SOMETHIN on those directories
   dumping the core .

> *******************************************************************
>
> Bob Adams                               Eastman Kodak Company
> Systems Security Engineer               1447 St. Paul Street
> Email: adams () Kodak com                  Mail Code 37009
> Phone:  (716) 253-5281                  Rochester, NY  14653-7009
> Fax:    (716) 253-5846
>
> ******************************************************************