BSD tty security, part 4: What You Can Look Forward To

[Matthew T. Russotto]

In article <1991Apr30.224740.17040 at pcserver2.naitc.com> kdenning at pcserver2.naitc.com (Karl Denninger) writes:
>
>The most obvious attempts, taking over "unused" ptys slave ends, result in
>the system skipping them when assignment time comes around.  This prevents
>the most obvious ways to exploit this hole.  I believe MIPS may be using
>some form of "O_EXCL" to prevent multiple access....
>
>The RS/6000 dynamically creates ptys, and thus doesn't suffer from the
>problem at all.
>
>ISC, Apple (A/UX), and Sun, DO have the problem.
>
>KUDOS TO MIPS ON THIS ONE.  They got it right.

With Sun and Ultrix, you seem to be able to affect telnets while the 'login'
and 'passwd:' prompts are up-- once the session starts, Ultrix stops the
TIOCSTI process, and Sun hangs up both the incoming telnet and the TIOCSTI
process.  A/UX doesn't even have TIOCSTI-- am I missing something?
--
Matthew T. Russotto	russotto at eng.umd.edu	russotto at wam.umd.edu
     .sig under construction, like the rest of this campus.