Date: Thu, 07 Sep 2000 15:32:56 -0600 From: Warner Losh <imp@village.org> To: "Todd C. Miller" <Todd.Miller@courtesan.com> Cc: Kris Kennaway <kris@FreeBSD.org>, "Vladimir Mencl, MK, susSED" <mencl@nenya.ms.mff.cuni.cz>, freebsd-security@FreeBSD.org, security-officer@FreeBSD.org, millert@openbsd.org Subject: Re: UNIX locale format string vulnerability (fwd) Message-ID: <200009072132.PAA06187@harmony.village.org> In-Reply-To: Your message of "Thu, 07 Sep 2000 15:26:56 MDT." <200009072126.e87LQuE12710@xerxes.courtesan.com> References: <200009072126.e87LQuE12710@xerxes.courtesan.com> <Pine.BSF.4.21.0009071356030.8316-100000@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <200009072126.e87LQuE12710@xerxes.courtesan.com> "Todd C. Miller" writes: : In message <Pine.BSF.4.21.0009071356030.8316-100000@freefall.freebsd.org> : so spake Kris Kennaway (kris): : : > Again, the problem here is with sudo, not with something that comes in : > FreeBSD. : : How is this a sudo problem? Do you expect sudo to strip away the NLS : env vars for you? This would not be unprecedented, as sudo already : strips out LD_* and friends but breaking locales seems a bit dodgy. : : As I haven't seen the entire thread I'm clearly missing some info... That's why I asked for more specific details... So far I've not seen any. He's basically worried that someone could use the LC_* variables to exploit bugs in the locale code's lack of checking of %n arguments. eg setenv LOCALE_PATH /my/evil/stuff setenv LC_LANG "my_Evil" sudo ls It seems like a longshot to me, or I misunderstand something. Warner To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200009072132.PAA06187>