From owner-freebsd-security Thu Sep 7 14:36:44 2000 Delivered-To: freebsd-security@freebsd.org Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42]) by hub.freebsd.org (Postfix) with ESMTP id 754A937B42C; Thu, 7 Sep 2000 14:36:39 -0700 (PDT) Received: (from ache@localhost) by nagual.pp.ru (8.11.0/8.11.0) id e87La0919181; Fri, 8 Sep 2000 01:36:00 +0400 (MSD) (envelope-from ache) Date: Fri, 8 Sep 2000 01:35:57 +0400 From: "Andrey A. Chernov" To: Warner Losh Cc: "Todd C. Miller" , Kris Kennaway , "Vladimir Mencl, MK, susSED" , freebsd-security@FreeBSD.ORG, security-officer@FreeBSD.ORG, millert@openbsd.org Subject: Re: UNIX locale format string vulnerability (fwd) Message-ID: <20000908013556.A19114@nagual.pp.ru> References: <200009072126.e87LQuE12710@xerxes.courtesan.com> <200009072126.e87LQuE12710@xerxes.courtesan.com> <200009072132.PAA06187@harmony.village.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <200009072132.PAA06187@harmony.village.org>; from imp@village.org on Thu, Sep 07, 2000 at 03:32:56PM -0600 Organization: Biomechanoid Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Thu, Sep 07, 2000 at 03:32:56PM -0600, Warner Losh wrote: > : How is this a sudo problem? Do you expect sudo to strip away the NLS > : env vars for you? This would not be unprecedented, as sudo already > : strips out LD_* and friends but breaking locales seems a bit dodgy. > : > : As I haven't seen the entire thread I'm clearly missing some info... > > That's why I asked for more specific details... So far I've not seen > any. > > He's basically worried that someone could use the LC_* variables to > exploit bugs in the locale code's lack of checking of %n arguments. 'sudo' port *must* strip NLSPATH and PATH_LOCALE variables. No other actions required. -- Andrey A. Chernov http://ache.pp.ru/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message