From owner-freebsd-security Thu Sep 7 14:33:15 2000 Delivered-To: freebsd-security@freebsd.org Received: from rover.village.org (rover.village.org [204.144.255.49]) by hub.freebsd.org (Postfix) with ESMTP id C2ECE37B422; Thu, 7 Sep 2000 14:33:09 -0700 (PDT) Received: from harmony.village.org (harmony.village.org [10.0.0.6]) by rover.village.org (8.9.3/8.9.3) with ESMTP id PAA39071; Thu, 7 Sep 2000 15:33:06 -0600 (MDT) (envelope-from imp@harmony.village.org) Received: from harmony.village.org (localhost.village.org [127.0.0.1]) by harmony.village.org (8.9.3/8.8.3) with ESMTP id PAA06187; Thu, 7 Sep 2000 15:32:56 -0600 (MDT) Message-Id: <200009072132.PAA06187@harmony.village.org> To: "Todd C. Miller" Subject: Re: UNIX locale format string vulnerability (fwd) Cc: Kris Kennaway , "Vladimir Mencl, MK, susSED" , freebsd-security@FreeBSD.org, security-officer@FreeBSD.org, millert@openbsd.org In-reply-to: Your message of "Thu, 07 Sep 2000 15:26:56 MDT." <200009072126.e87LQuE12710@xerxes.courtesan.com> References: <200009072126.e87LQuE12710@xerxes.courtesan.com> Date: Thu, 07 Sep 2000 15:32:56 -0600 From: Warner Losh Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org In message <200009072126.e87LQuE12710@xerxes.courtesan.com> "Todd C. Miller" writes: : In message : so spake Kris Kennaway (kris): : : > Again, the problem here is with sudo, not with something that comes in : > FreeBSD. : : How is this a sudo problem? Do you expect sudo to strip away the NLS : env vars for you? This would not be unprecedented, as sudo already : strips out LD_* and friends but breaking locales seems a bit dodgy. : : As I haven't seen the entire thread I'm clearly missing some info... That's why I asked for more specific details... So far I've not seen any. He's basically worried that someone could use the LC_* variables to exploit bugs in the locale code's lack of checking of %n arguments. eg setenv LOCALE_PATH /my/evil/stuff setenv LC_LANG "my_Evil" sudo ls It seems like a longshot to me, or I misunderstand something. Warner To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message