COMMAND
	    login(1)
SYSTEMS AFFECTED
	    BSD-net2 systems.
	    FreeBSD 1.02.,  1.1 and  current, Net-BSD-current,  BSDI's BSD/386
	    1.1 and BSD 4.4 is not affected
PROBLEM
	    There is a bug in NET-net2 version of login.c which allows  anyone
	    who has an  account on the  machine to gain  root priviledges. The
	    version of login.c has the fallowing sccsid line:
	
	        static char sccsid[]="@(#)login.c  5.73 (Berkeley) 6/29/91"
	
	    The bug  is that  it doesn't  reset the  root login  flag after an
	    unsuccessful attempt to login as root. The upshot of this is  that
	    if a person first attempts to  login as root, fails, then logs  in
	    as him/herself, he/she has a uid of 0!
SOLUTION
	    The fix is to add the line:
	
	        rootlogin = 0;
	
	    After the code:
	
	        if (pwd && !rval)
	        break;
	
	    I  don't  know  if  there  are  any  other  versions  of this code
	    which  also  have  the  same  problem.  I suggest that if you have
	    a Net2-BSD derived system you check login.c and fix it ASAP.