Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Posting-Version: version B 2.10.2 9/18/84; site dual.UUCP
Path: utzoo!watmath!sunybcs!dual!mats
From: mats@dual.UUCP (Mats Wichmann)
Newsgroups: net.micro.att
Subject: Re: S-bit set on UnixPC mv
Message-ID: <1059@dual.UUCP>
Date: Sun, 28-Jul-85 14:47:53 EDT
Article-I.D.: dual.1059
Posted: Sun Jul 28 14:47:53 1985
Date-Received: Mon, 29-Jul-85 06:59:13 EDT
References: <1284@cwruecmp.UUCP>
Organization: Dual Systems, Berkeley, CA
Lines: 29

> 
> A friend of mine noticed this, but the way at&t ships the Unix Pc software,
> the set uid bit on /bin/mv is set, and it is owned by root.  He seems to
> think that this is a "back door" for the telephone support people, but it's
> a giant security breach, especially to those people at&t is trying to market
> to, business people who know little or nothing about Unix.
> 

Ahem, this is true of all Sys releases, and is not a back-door unless
someone left something else unprotected. The setuid bit stays
effective for a very short while - long enough to determine whether
the requested operation is renaming directories, which has to be
done by root. As soon as it has been found that this is not the
operation requested, the effective user ID is changed back to
the real user ID, and superuser privelge goes away.

Of course, if someone left /etc read/write by everyone, the
above mentioned moving of the password file can be done. But that
is certainly not the fault of the setuid-bit on mv!!!

(By the way, one of the most common problems I have found in
people building systesm from scratch it that the root directory
is left read-write for everyone. Try an `ls -ld /' on your
machine.....should be mode 755 or maybe 775.....if it is 777,
someone can easily break in to your system....)

    Mats Wichmann
    Dual Systems
    ...{ucbvax,ihnp4,cbosgd,decwrl,fortune}!dual!mats