Path: utzoo!attcan!uunet!auspex!guy
From: guy@auspex.UUCP (Guy Harris)
Newsgroups: comp.unix.wizards
Subject: Re: Implications of recent virus (Trojan Horse) attack
Keywords: virus security
Message-ID: <455@auspex.UUCP>
Date: 15 Nov 88 18:05:43 GMT
References: <1698@cadre.dsl.PITTSBURGH.EDU> <2151@ficc.uu.net> <8845@smoke.BRL.MIL> <14465@mimsy.UUCP> <8858@smoke.BRL.MIL> <439@auspex.UUCP> <8879@smoke.BRL.MIL>
Reply-To: guy@auspex.UUCP (Guy Harris)
Distribution: na
Organization: Auspex Systems, Santa Clara
Lines: 11

>In article <439@auspex.UUCP> guy@auspex.UUCP (Guy Harris) writes:
>>If that fix is "have 'getpwent()' return NULL if the entry it looks at
>>is syntactically incorrect," the fix is simple but rather rude;
>
>That would be rude but it wasn't what I was talking about.
>All you really need to do is to skip over a bogus entry and
>resynchronize for the next one.

It may not be what you were talking about, but it's what AT&T did, at
least in S5R3 and S5R3.1.  As I think I stated, skipping bogus entries
and proceeding to the next valid entry is, indeed, the right fix.