Path: utzoo!mnetor!tmsoft!torsqnt!news-server.csri.toronto.edu!cs.utexas.edu!sdd.hp.com!usc!jarthur!uunet!fub!dobag.in-berlin.de!lumpi From: lumpi@dobag.in-berlin.de (Joern Lubkoll) Newsgroups: comp.unix.sysv386 Subject: Re: SECURITY BUG IN INTERACTIVE UNIX SYSV386 Keywords: BAD BUG Message-ID: <6A5NSZK@dobag.in-berlin.de> Date: 12 Feb 91 22:52:49 GMT References: <1991Feb11.184130.11321@jwt.UUCP> <1991Feb12.020625.6779@kithrup.COM> <529@jahangir.UUCP> Organization: Dobag Computer Systems Berlin Lines: 19 marc@jahangir.UUCP (Marc Rossner) writes: >> In article <1991Feb11.184130.11321@jwt.UUCP> john@jwt.UUCP (John Temples) writes: >> >Yikes. This also works on ESIX-D without a coprocessor, and on ISC 2.0.2 >> >*with* a coprocessor. It failed on Microport 2.2 with a coprocessor. >> >Now, the question is, what do we do to protect ourselves in the meantime? >Works like a charm on ISC 2.2 with a 486 -- good thing the only people >over here that read this newsgroup already know the root password. >"Feature", indeed! Hope ISC hears a lot about this, if anyone can ever >get past the 15 minutes it takes their telephone guy to locate you in his >files before he'll let you discuss anything real. Set UAREAUS and UAREARW to zero and it won't work any more ! But this works onlu on ISC 2.2 and not on 2.02. No 2.02 system can be protected ! jl -- lumpi@dobag.in-berlin.de -- "Nothing is the complete absence of everything."