Security Incidents mailing list archives

Re: solaris nscd cores


From: Fyodor <fygrave () tigerteam net>
Date: Sun, 2 Dec 2001 11:37:13 +0700

On Sat, Dec 01, 2001 at 10:06:35PM -0500, Greg A. Woods wrote:

    If I find anything else I'll post to the list.

There are a couple of things majorly wrong with this picture.  So far as
I know the only way a process will ever get "signal 9" (SIGKILL) is if
someone running with the same privileges as the process, or as the
superuser, manually sends it.  Also so far as I know you'll never get a
core dump from a SIGKILL, at least not on SunOS.

Either your debugger is lying, or something's really broken worse than
it appears (could ncsd have sent itself SIGKILL?).


or it could be a watchdog thread/process which commits suicide in case is
something went wrong. Just a blind guess..


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com


Current thread: