Cuserid() is a security hole

[Darryl Wagoner]

Neither cuserid(3) or getlogin(3) in Ultrix checks stdin for user
information.  

The cuserid(3) routine tries to do a getlogin(3); if it fails, it then does a
getpwuid(3) of the real uid.

The getlogin(3) routine only gets login information from utmp.

I have never checked this on other systems, but would be interested in knowing
if this is indeed a bug on other versions of Unix. 



-- 
Darryl Wagoner			wagoner at imokay.dec.com
Digital				(work) 508.264.5586
Secure Workstation Project 	(DTN)  293.5586
Boxboro, Ma.