su - user question

[Adam Warner <lists@consulting.net.nz>]

Hi everyone,

I'm just wondering about the safety of this security practice.

Firstly the servers are physically secure and there is no relevant issue
about having a local root console open for administration purposes.

The question I have is if I "su - username" and then browse the web,
etc. is it impossible for a remote user who managed to gain access to
that user session to become root by exiting out of the user account?

I'm almost certain the answer should be no. But I'd just like
confirmation.

Thanks,
Adam