Re: Exploiting Zolaris 2.4 ?? :)

[casper () holland Sun COM (Casper Dik)]

> I think this bug is widely spreaded in Korea . but not all over the world.
> The following contents are wholly from SeokChan Lee,  one of the best alu
> mnus of the legendaray security task force team .K** .
> Also whom I look up to ..:)
>
> The problem is the Core dump system of Zolaris 2.4 .
> let's look into the man page of core(4) . and then concentrate on one phr-
> ase .


Set-uid/set-gid programs shouldn't dump core.

They don't in Solaris 2.5/2.5.1, but did under some circumstances in 2.4.
This is fixed in a later kernel jumbo patch (-35 for SPARC)


The files/directories shouldn't be group writable anyway;
better run:

        ftp.fwi.uva.nl:/pub/solaris/fix-modes*

on your Solaris systems.

Casper