From ust@cert.siemens.de  Thu Mar 15 23:19:35 2001
Return-Path: <ust@cert.siemens.de>
Received: from david.siemens.de (david.siemens.de [192.35.17.14])
	by hub.freebsd.org (Postfix) with ESMTP id B3BFB37B718
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 15 Mar 2001 23:19:34 -0800 (PST)
	(envelope-from ust@cert.siemens.de)
Received: from mail1.siemens.de (mail1.siemens.de [139.23.33.14])
	by david.siemens.de (8.11.0/8.11.0) with ESMTP id f2G7JXt29053
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 16 Mar 2001 08:19:33 +0100 (MET)
Received: from mars.cert.siemens.de (ust.mchp.siemens.de [139.23.201.17])
	by mail1.siemens.de (8.11.0/8.11.0) with ESMTP id f2G7JWi00613
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 16 Mar 2001 08:19:32 +0100 (MET)
Received: from alaska.cert.siemens.de (reims.mchp.siemens.de [139.23.202.134])
	by mars.cert.siemens.de (8.11.3/8.11.3/Siemens CERT [ $Revision: 1.8 ]) with ESMTP id f2G7JWC82706
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 16 Mar 2001 08:19:32 +0100 (CET)
	(envelope-from ust@alaska.cert.siemens.de)
Received: (from ust@localhost)
	by alaska.cert.siemens.de (8.11.3/8.11.3/alaska [ $Revision: 1.5 ]) id f2G7JW333470;
	Fri, 16 Mar 2001 08:19:32 +0100 (CET)
Message-Id: <200103160719.f2G7JW333470@alaska.cert.siemens.de>
Date: Fri, 16 Mar 2001 08:19:32 +0100 (CET)
From: Udo Schweigert <ust@cert.siemens.de>
Reply-To: ust@cert.siemens.de
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: Little bug in /etc/security
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         25845
>Category:       conf
>Synopsis:       Improvement for /etc/security
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Mar 15 23:20:01 PST 2001
>Closed-Date:    Sat Mar 17 13:22:36 PST 2001
>Last-Modified:  Sat Mar 17 13:23:08 PST 2001
>Originator:     Udo Schweigert
>Release:        FreeBSD 4.3-BETA i386
>Organization:
>Environment:
System: FreeBSD alaska.cert.siemens.de 4.3-BETA FreeBSD 4.3-BETA #12: Tue Mar 13 10:10:56 CET 2001 ust@alaska.cert.siemens.de:/usr/obj/work/src/RELENG_4/sys/alaska i386


>Description:

/etc/security gives a list of uid 0 accounts. When looking into 
/etc/master.passwd it does not ignore comments. Thus a comment like this:

# $Ust: hosts/merkur/master.passwd,v 1.2 2001/01/30 15:00:13 ust Exp $

gives a nonexisting account (# $Ust) because the third field (if having ":" as
field separator) is equal to zero.

Since /etc/master.passwd could change in the future there is some
chance of having "00" as third field in # $FreeBSD$, this should be fixed.

>How-To-Repeat:
>Fix:
--- security.orig	Wed Mar  7 14:45:43 2001
+++ security	Fri Mar 16 08:06:37 2001
@@ -117,7 +117,7 @@
 
 separator
 echo 'Checking for uids of 0:'
-n=$(awk -F: '$3==0 {print $1,$3}' /etc/master.passwd |
+n=$(awk -F: '/^#/ {next} $3==0 {print $1,$3}' /etc/master.passwd |
     tee /dev/stderr |
     sed -e '/^root 0$/d' -e '/^toor 0$/d' |
     wc -l)
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: brian 
State-Changed-When: Sat Mar 17 13:22:36 PST 2001 
State-Changed-Why:  
Applied to -current, thanks. 
I'll MFC after the code freeze. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=25845 
>Unformatted:
