Path: utzoo!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!samsung!zaphod.mps.ohio-state.edu!usc!snorkelwacker!bloom-beacon!eru!luth!sunic!mcsun!ukc!stl!idec!prlhp1!gupta
From: gupta@prlhp1.prl.philips.co.uk (Ashok Gupta)
Newsgroups: comp.sys.apollo
Subject: Security Problem
Message-ID: <1066@prlhp1.prl.philips.co.uk>
Date: 12 Mar 90 14:14:45 GMT
Organization: Philips Research Laboratories, Redhill, UK
Lines: 38


There is a potentially serious security problem on Apollo's.

If one quits from `mail' and logs off immediately then the 
shell running mail does not get closed. I say it is only 
potentially serious because one has to log off as soon
as quitting from mail for the problem to occur - and therefore
the rapid sequence of events must be of low probability.

If one was running mail from the C-shell, its pad gets closed.
However, if running mail from the Bourne and Aegis shells, their 
pads stay open.

Pads to all shells - other than the one running mail - are closed.
The system is in login mode and the login prompt is displayed.

/bin/ps -aux does not show the running  shell.
/com/pst does - and indicates it's active.
/com/lusr -allp -n on my node, says no one's logged in but
  shows the running shell process.
Hitting the <Edit> and <Read> keys causes the message
 `Command is not allowed during login' to be displayed.

The running shell has my privileges.   I can cat, print,
sed, delete files.

To close the shell I have to <CNTRL> Z and <CNTRL> N.

This was first observed on an Apollo 3000 running SR9.7
where the problem is reproducible.

It was not reproducible on a 3500 running SR10.2.

-- 
Ashok "Ash" Gupta
Post : Philips Research Labs, Crossoak Lane, Redhill, Surrey, RH1 5HA, U.K.
Voice: +44 293 785544 ext 5647
JANET: gupta@prl.philips.co.uk  ARPA: gupta%prl.philips.co.uk@nsfnet-relay.ac.uk