Re:Authentication Vulnerabilities in OpenBSD
by asveikau on Wednesday December 04, 2019 @09:23PM
(#21709412)
> They're shelling out to a command line program to do authentication
Interesting to track who exactly "they" might have been, as many commenters are saying this is uncharacteristic for OpenBSD.
Looking at the patch, the first OpenBSD commit of this file [1] is from 2000 and says "from BSDI" in the commit message, did fork()+execve() at that time, and the BSDI copyright comment says 1995-1997.
Probable to say more recent OpenBSD stuff is likely not written this way, but that they have baggage like this in the tree from earlier times.
Interesting to track who exactly "they" might have been, as many commenters are saying this is uncharacteristic for OpenBSD.
Looking at the patch, the first OpenBSD commit of this file [1] is from 2000 and says "from BSDI" in the commit message, did fork()+execve() at that time, and the BSDI copyright comment says 1995-1997.
Probable to say more recent OpenBSD stuff is likely not written this way, but that they have baggage like this in the tree from earlier times.
[1] https://cvsweb.openbsd.org/src/lib/libc/gen/auth_subr.c?rev=...