LOGWATCH EXPLOIT ROOT COMPROMISE

From: Bailey Kong (bailey@tgpsolutions.com)
Date: 03/29/02 

From: "Bailey Kong" <bailey@tgpsolutions.com>
To: <security-basics@securityfocus.com>
Date: Thu, 28 Mar 2002 22:14:14 -0800

if you haven't heard yet, root account can be compromised by a local account
using logwatch.

the current work around i got was to chattr +i /etc/passwd

that makes it so /etc/passwd can't be modified, if and when you need to add
a user you can simply do chattr -i /etc/passwd

i hope no one has gotten compromised yet

Bailey