From owner-freebsd-security Thu Sep 7 14:45: 8 2000 Delivered-To: freebsd-security@freebsd.org Received: from rover.village.org (rover.village.org [204.144.255.49]) by hub.freebsd.org (Postfix) with ESMTP id E983D37B422; Thu, 7 Sep 2000 14:45:01 -0700 (PDT) Received: from harmony.village.org (harmony.village.org [10.0.0.6]) by rover.village.org (8.9.3/8.9.3) with ESMTP id PAA39175; Thu, 7 Sep 2000 15:44:58 -0600 (MDT) (envelope-from imp@harmony.village.org) Received: from harmony.village.org (localhost.village.org [127.0.0.1]) by harmony.village.org (8.9.3/8.8.3) with ESMTP id PAA06367; Thu, 7 Sep 2000 15:44:48 -0600 (MDT) Message-Id: <200009072144.PAA06367@harmony.village.org> To: Kris Kennaway Subject: Re: UNIX locale format string vulnerability (fwd) Cc: "Todd C. Miller" , "Vladimir Mencl, MK, susSED" , freebsd-security@FreeBSD.org, security-officer@FreeBSD.org, millert@openbsd.org In-reply-to: Your message of "Thu, 07 Sep 2000 14:39:30 PDT." References: Date: Thu, 07 Sep 2000 15:44:48 -0600 From: Warner Losh Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org In message Kris Kennaway writes: : Now, I haven't fully explored to what extent this is possible on FreeBSD - : I believe the first one is a problem if sudo is used on third party : applications, but I'm not sure if the second one is, i.e. whether we : disallow use of '/' in the appropriate locale variables. We already disallow this. You can't set your lang to be ../../../../../../etc/master.password, for example. If the LANG variable has / in it, it is ignored. I think that the only one that needs this restriction. Warner To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message