Re: Possible SunOS 5.5.1 sulogin vulnerability

[casper () holland Sun COM (Casper Dik)]

> Possible hole in sulogin here?  Under Solaris 2.5.1 (sparc & x86),
> executing /sbin/sulogin from an unprivileged user account dumps you
> into what appears to be single-user mode with an ugly warning message
> without prompting for the root password.  You don't find this with
> earlier versions of Solaris (2.5 and lower).

It's a Bourne shell; the only difference with a regular /sbin/sh
invocation is that it prints:

                *** NO ENTRY FOR root IN PASSWORD FILE! ***

                Entering System Maintenance Mode

before starting the shell.

And that's because you're not root.

The difference between 2.5- and 2.5.1 is that the set-uid bit, which
is non-sensical for programs that are supposed to be only started by root
anyway, was dropped.

Casper