A.P. Lawrence

userOsa can overwrite passwd and shadow

If this isn't exactly what you wanted, please try our Search (there's a LOT of techy and non-techy stuff here about Linux, Unix, Mac OS X and just computers in general!):

From - Wed Oct 13 06:36:13 1999
Xref: world comp.unix.sco.misc:107295
Path: world!newsfeed.mathworks.com!cam-news-hub1.bbnplanet.com!washdc3-snh1.gtei.net!news.gtei.net!dfiatx1-snr1.gtei.net.POSTED!not-for-mail
Newsgroups: comp.unix.sco.misc
Subject: Re: BUGTRAQ report References: <7tvq0m$gu1$1@hendrix.postino.com>
Organization: Gulfnet Kuwait
X-Newsreader: trn 4.0-test67 (15 July 1998)
From: john@kuwait.net (John Temples)
Lines: 9 Message-ID: <zOLM3.401$uI3.20885@dfiatx1-snr1.gtei.net>
X-Trace: 9+o0fRhXNTQnkWPEO4/lblJGOWteJr19Q1cQgZlSFRXO9V0VNM/5oBv8d3FIUbv1hYSvoT77irh7!J1SFY8+LSU6+rWg/CvLlGpe1xD+YP5sQOGTmGtFK2QxZ/1Dk5PG9IG82MBu2sWne0j2Me9Q=
X-Complaints-To: abuse@gte.net
X-Abuse-Info: Please be sure to forward a copy of ALL headers
X-Abuse-Info: Otherwise we will be unable to process your complaint properly
NNTP-Posting-Date: Tue, 12 Oct 1999 19:16:47 GMT
Distribution: world
Date: Tue, 12 Oct 1999 19:16:47 GMT
X-Mozilla-Status: 8010

In article <7tvq0m$gu1$1@hendrix.postino.com>,
Danny Aldham <danny@hendrix.postino.com> wrote:
>Any user may overwrite any file with group auth (i.e. /etc/shadow,
>/etc/passwd) using /etc/sysadm.d/bin/userOsa.

My quick fix for this is to edit userOsa and replace the string
"debug.log" with "/dev/null".
-- 
John W. Temples, III

Phone and Email Support at Monthly rates