odd setuid diffs

From: Mikhail Kruk (meshko@cs.brandeis.edu)
Date: 04/03/01 

Date: Tue, 3 Apr 2001 00:00:18 -0400 (EDT)
From: Mikhail Kruk <meshko@cs.brandeis.edu>
To: <security@freebsd.org>

I got very strange (IMHO) setuid diffs in my security reports today... Any
explanations appreciated:

xxxx.xxxx.xxx setuid diffs:
69c69
< 1698870 -rwsr-xr-x 1 root wheel 219148 Jul 19 16:20:56 2000
/usr/local/bin/screen-3.9.5 

---
> 1698870 -rwsr-xr-x  1 root  wheel    219148 Jul 19 17:20:56 2000
/usr/local/bin/screen-3.9.5
71c71
< 1230184 -rwsr-xr-x  1 root  bin      264148 Jun  3 22:19:08 1999
/usr/local/sbin/hfaxd
---
> 1230184 -rwsr-xr-x  1 root  bin      264148 Jun  3 23:19:08 1999
/usr/local/sbin/hfaxd
They are off by one hour, all right. I see possible cause: yesterday I've
noticed that my time was set to EST instead of EDT and changed my
timezone (one hour difference). But the question is: why those two files,
not the rest of them?? What do they have in common?
(Running 4.3-BETA FreeBSD 4.3-BETA #11: Fri Mar  9 03:36:40 EST 2001)
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message