Re: [cobalt-security] RE: POSSIBLE MAJOR SECURITY BREACH

[Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>]

On Saturday 09 February 2002 09:34 am, Gerald Waugh wrote:
> On Saturday 09 February 2002 05:10 am, Render-Vue wrote:
> > Hi Yah,
> >
> > A RaQ3 that initially had the old version of Neomail installed then the
> > updated security patch applied as soon as it came out...
> >
> > /etc/shadow  	400
> > /etc/shadow-  	600
> > both root root
>
> The spare RaQ4 had neonail 1.25-3 on it
> I installed neonail 1.25-5
> and the shadow files ARE:
> -r--------   1 root     root          552 Oct  1 19:14 /etc/shadow
> -rw-------   1 root     root          552 Sep 30 05:46 /etc/shadow-
>
> So, it looks like neomail is not the culprit (on a RaQ4 anyway)
> Maybe I'll try a RaQ3, but I think Barbra had a RaQ4

OK so I installed neomail 1.25-5 on a RaQ3 and;
-r--------   1 root     root          852 Dec 19 13:36 /etc/shadow
-r--------   1 root     root          807 Dec 19 13:36 /etc/shadow-

Interesting that on the raQ3 shadow- is 400 and on the Ra4 it's 600

-- 
Gerald Waugh