Security Incidents mailing list archives
Re: solaris nscd cores
From: Fyodor <fygrave () tigerteam net>
Date: Sun, 2 Dec 2001 11:37:13 +0700
On Sat, Dec 01, 2001 at 10:06:35PM -0500, Greg A. Woods wrote:
If I find anything else I'll post to the list.There are a couple of things majorly wrong with this picture. So far as I know the only way a process will ever get "signal 9" (SIGKILL) is if someone running with the same privileges as the process, or as the superuser, manually sends it. Also so far as I know you'll never get a core dump from a SIGKILL, at least not on SunOS. Either your debugger is lying, or something's really broken worse than it appears (could ncsd have sent itself SIGKILL?).
or it could be a watchdog thread/process which commits suicide in case is something went wrong. Just a blind guess.. ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- Re: solaris nscd cores mikeDOTd (Dec 01)
- Re: solaris nscd cores Greg A. Woods (Dec 01)
- Re: solaris nscd cores Fyodor (Dec 02)
- Re: solaris nscd cores j.e.r.k. ROCKS (Dec 04)
- Re: solaris nscd cores j.e.r.k. ROCKS (Dec 04)
- Re: solaris nscd cores Greg A. Woods (Dec 01)