flaw in dmesg under Solaris

From: echo8 (echo8at_private)
Date: Tue Nov 09 1999 - 11:22:01 PST

  • Next message: Gerardo Richarte: "Re: ImmuniX OS Security Alert: StackGuard 1.21 Released"

    Under all versions of Solaris prior to 2.7, and under 2.7 prior to patch
    106541-07, /usr/sbin/dmesg, when called with the "-" argument, creates
    /var/adm/msgbuf owned and writeable by the user who ran the utility, assuming
    that the file didn't already exist (it won't until someone runs dmesg -). Once
    the file exists, "dmesg -" will not work properly for any other user, and the
    file remains, onwed by the user who called the utility.
    
    Under Solaris 2.7, patch 106541-07 addresses the problem by replacing
    /usr/sbin/dmesg with a shell script which breaks the functionality of the "-"
    argument entirely.
    
    Obviously, Sun is aware of the problem, but I spoke to them on 9/21/99 to
    open a service order and get a bugid assigned. I've heard nothing since
    then.
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:11:02 PDT