From owner-freebsd-security  Thu Sep  7 14:40:34 2000
Delivered-To: freebsd-security@freebsd.org
Received: from xerxes.courtesan.com (64-6-178-150.den1.phoenixdsl.net [64.6.178.150])
	by hub.freebsd.org (Postfix) with ESMTP
	id CB0CC37B42C; Thu,  7 Sep 2000 14:40:31 -0700 (PDT)
Received: from xerxes.courtesan.com (millert@localhost)
	by xerxes.courtesan.com (8.10.1/8.10.1) with ESMTP id e87Le3715994;
	Thu, 7 Sep 2000 15:40:03 -0600 (MDT)
Message-Id: <200009072140.e87Le3715994@xerxes.courtesan.com>
To: "Andrey A. Chernov" <ache@nagual.pp.ru>
Cc: Warner Losh <imp@village.org>,
	"Todd C. Miller" <Todd.Miller@courtesan.com>,
	Kris Kennaway <kris@FreeBSD.ORG>,
	"Vladimir Mencl, MK,     susSED" <mencl@nenya.ms.mff.cuni.cz>,
	freebsd-security@FreeBSD.ORG, security-officer@FreeBSD.ORG
Subject: Re: UNIX locale format string vulnerability (fwd) 
In-reply-to: Your message of "Fri, 08 Sep 2000 01:35:57 +0400."
             <20000908013556.A19114@nagual.pp.ru> 
References: <200009072126.e87LQuE12710@xerxes.courtesan.com> <Pine.BSF.4.21.0009071356030.8316-100000@freefall.freebsd.org> <200009072126.e87LQuE12710@xerxes.courtesan.com> <200009072132.PAA06187@harmony.village.org> <20000908013556.A19114@nagual.pp.ru> 
Date: Thu, 07 Sep 2000 15:40:03 -0600
From: "Todd C. Miller" <Todd.Miller@courtesan.com>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

In message <20000908013556.A19114@nagual.pp.ru>
	so spake "Andrey A. Chernov" (ache):

> 'sudo' port *must* strip NLSPATH and PATH_LOCALE variables. No other
> actions required.

That seems pretty reasonable.  I'll strip those out of the environment
in sudo 1.6.4.

 - todd


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message