OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 2nd quarter (Apr-Jun) 1994: Re: "passwd -F" vulnerability?

Re: "passwd -F" vulnerability?

Greg Woods (woodsncar.ucar.edu)
Wed, 11 May 94 9:57:26 MDT 

> Do
> 
> 	passwd -F /etc/shadow
> 
> Now the shadow password file is visible in /var/adm/messages.

At least on SunOS 4.1.3, where the equivalent command is

passwd -F /etc/security/passwd.adjunct

this doesn't work. If the file it is trying to read is sort of in
/etc/passwd format (colon-separated fields), then you will get
a complaint like

May 11 09:49:00 ncar passwd[7959]: null uid:  "root"

for each line of the file, so fortunately it does not actually allow
the shadow passwd file to be read on SunOS 4.1.3. However, for other
unreadable files, it works just fine so it is still a serious security
hole.

--Greg