Classic Unix Security Problems

`/bin/su`

What does it do?
It prompts the user for a username U and password
Checks the password against /etc/passwd; quits if it's the wrong one
Otherwise, run a shell as user U
To run a shell as user U, the su process must already be running as either U or as UID 0
Thus, /bin/su is owned by root and has the setuid bit enabled:

        % ls -l /bin/su
        -rwsr-xr-x    1 root     root        14112 Jan 16  2001 /bin/su