Patch-ID# 101481-01 Keywords: security, dump, in.comsat, in.talkd, shutdown, syslogd, write, 4.1.x Synopsis: SunOS 4.1.3: Security update for shutdown. Date: Mar/16/94 Solaris Release: 1.1 SunOS Release: 4.1.3C 4.1.3 4.1.2 4.1.1 Unbundled Product: Unbundled Release: Relevant Architectures: sun3 sun3x sun4 sun4c sun4m BugId's fixed with this patch: 1140162 Changes incorporated in this version: 1140162 Patches accumulated and obsoleted by this patch: Patches which conflict with this patch: Patches required with this patch: 100272(-07+) 100593(-03+) 100909(-02+) 101480 101482 Obsoleted by: 4.1.3_U1 Files included with this patch: shutdown Problem Description: 1140162 Several programs, as originally shipped, could be exploited in an obscure way to gain root access. Patch Installation Instructions: 1) Login as root. 2) Make a backup copy of the old file: mv /usr/etc/shutdown /usr/etc/shutdown.fcs 3) Change the permissions on the saved file to prevent its execution: chmod 400 /usr/etc/shutdown.fcs 4) Copy in the patched file: cp `uname -m`/`uname -r`/shutdown /usr/etc/shutdown 5) Set ownership & permissions: chown root /usr/etc/shutdown chgrp operator /usr/etc/shutdown chmod 4754 /usr/etc/shutdown