> From: Nate Eldredge [mailto:nge@xxxxxxxxxx] > Sent: Friday, 16 February, 2007 21:42 > > On Sat, 17 Feb 2007, Darren Reed wrote: > > > > > Solaris's /bin/login has never supported the "-f" command line option > > until Solaris 10 (RTFM) so this exploit was just plain not possible. > > That is not correct. On a Solaris 8 box the -f option is accepted without > error. Which does not show that it's "supported". /bin/true accepts the -f option, too. > I don't have root so I can't verify that it does the right thing, You're using a Solaris 8 system with no entry in /etc/passwd for UID 0? Extraordinary. > but at least as a normal user "login -f asdfasdf" does nothing I haven't looked at the Solaris 10 login sources, but IIRC on AIX, this bug required that the username be appended to the -f ("-froot", not "-f root"). > while "login" without arguments presents a prompt. And what does "login -q asdfasdf" do? What about "login -z asdfasdf"? (I know what they do on a couple of older Solaris boxes I happen to have, but I'll leave this as an exercise for the reader.) -- Michael Wojcik Principal Software Systems Developer, Micro Focus
