Re: Cuserid() is a security hole

Article View: comp.bugs.2bsd

Article #256

#256

From: Leo de Wit
Date: Thu, 08 Jun 1989 11:17

17 lines
1148 bytes

In article <472@imokay.dec.com> wagoner@imokay.dec.com (Darryl Wagoner) writes:
|Neither cuserid(3) or getlogin(3) in Ultrix checks stdin for user
|information.  
|
|The cuserid(3) routine tries to do a getlogin(3); if it fails, it then does a
|getpwuid(3) of the real uid.
|
|The getlogin(3) routine only gets login information from utmp.
|
|I have never checked this on other systems, but would be interested in knowing
|if this is indeed a bug on other versions of Unix. 

On Ultrix, having read about the potential security problems with
getlogin(), it took me about 5 minutes to break a privilized setuid program
(read: become root) that relied upon getlogin() ... with a shell script!

    Leo.

Technical Details

Message-ID: <1041@philmds.UUCP>

Path: arc1-ca.pugleaf.net!utzoo!attcan!uunet!mcvax!hp4nl!phigate!philmds!leo

References: <289@levels.sait.edu.au> <472@imokay.dec.com>

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!utzoo!attcan!uunet!mcvax!hp4nl!phigate!philmds!leo
From: leo@philmds.UUCP (Leo de Wit)
Newsgroups: comp.bugs.2bsd,comp.bugs.4bsd,comp.bugs.sys5,comp.unix.wizards
Subject: Re: Cuserid() is a security hole
Message-ID: <1041@philmds.UUCP>
Date: 8 Jun 89 11:17:44 GMT
References: <289@levels.sait.edu.au> <472@imokay.dec.com>
Reply-To: leo@philmds.UUCP (Leo de Wit)
Organization: Philips I&E DTS Eindhoven
Lines: 17

Reply to Parent Message