COMMAND

    su

SYSTEMS AFFECTED

    HP/UX 9.00

PROBLEM

    The following info is based on Corinne Posse Security Notice Issue
    Number 5.

    When  a  user  su's  to  root  and  goes  idle,  the  other system
    administrator wants to kill the login shell for obvious  purposes.
    Normally, doing  this logs  the user  out and  kills and shells or
    programs that have been run from this shell, but this isn't  quite
    the case.

    What happens is this: It will appear as if the user has logged out
    of his/her dumb-terminal,  however there is  quite a surprise  (or
    present) for the next user of that terminal:

        login: myusername
        # ksh: myusername not found
        password:
        #

        login: uptime
        9:28PM  up 1 day, 58 mins, 6 users, load averages: 0.10, 0.17, 0.21
        password:

    Valdis  Kletnieks  added  that  he   suspects  the  follwoing   is
    happening.  When the other  sysadmin does a 'kill -9'  or whatever
    of the *parent  shell*, this is  failing to propagate  a SIGHUP to
    the shell spawned by the su  command (which makes sense, as it  is
    probablyin a  different process  group for  job control purposes).
    The login shell exits, the  su-shell keeps running.  init  notices
    the login shell exiting,  and re-spawns a getty.   You then get  a
    getty/login and a  su-shell fighting in  a race condition  for any
    given line of terminal input.

    The problem is probably exacerbated  by a lack of a  revoke() call
    in HP/UX  9.0, which  was designed  to close  exactly this  hole -
    getty can  revoke() on  the /dev/tty  and be  *sure* that no other
    processes are still reading.

SOLUTION

    HP may issue patch for this,  while you may be more carefull  with
    su to root.   Make sure to kill  the su-shell first, and  THEN the
    login shell.  If this is  too hard to remember, create a  shell or
    perl script.