OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 1st quarter (Jan-Mar) 1995: Re: Various Solaris 2.3 file permission problems

Re: Various Solaris 2.3 file permission problems

Darren Reed (avaloncoombs.anu.edu.au)
Sat, 7 Jan 1995 03:42:52 +1100 (EDT) 

> 
> > 
> > 
> > Various Solaris2.3, file permission problems
> > 
> [report itself is deleted]
> 
> Very interesting information, however more important things were not 
> mentioned:
> 
>        /tmp directory is writeable for "sys" group (root,bin,sys,adm are in
> sys group by default) (affected: Solaris 2.3 - 2.4)
> 
>       /usr/kvm/crash allows you to browse through kernel kvm (inherited sunos
> bug) (affected Solaris 2.3 - 2.4?)

well, its not setgid-sys...but is this any better, you wonder ?

-rwxr-sr-x   1 root     bin       147832 Jul 16 13:46 /usr/kvm/crash*

Of course, the ! bug seems to be fixed (at least !id doesn't mention bin,
which was the sunos4 bug; were there others ?).

Why does it even need to be setgid ?

I don't think chmod 700 is required (it isn't a dangerous program to let
users play with and sometimes I do not as root) for this.

darren