From owner-freebsd-security Wed Jan 16 18:31:22 2002 Delivered-To: freebsd-security@freebsd.org Received: from TYO201.gate.nec.co.jp (TYO201.gate.nec.co.jp [202.32.8.214]) by hub.freebsd.org (Postfix) with ESMTP id 913FD37B404 for ; Wed, 16 Jan 2002 18:31:15 -0800 (PST) Received: from mailgate4.nec.co.jp ([10.7.69.193]) by TYO201.gate.nec.co.jp (8.11.6/3.7W01080315) with ESMTP id g0H2V4f12824; Thu, 17 Jan 2002 11:31:04 +0900 (JST) Received: from mailsv.nec.co.jp (mailgate51.nec.co.jp [10.7.69.190]) by mailgate4.nec.co.jp (8.11.6/3.7W-MAILGATE-NEC) with ESMTP id g0H2V3C26295; Thu, 17 Jan 2002 11:31:03 +0900 (JST) Received: from necspl.do.mms.mt.nec.co.jp (necspl.do.mms.mt.nec.co.jp [10.16.5.21]) by mailsv.nec.co.jp (8.11.6/3.7W-MAILSV-NEC) with ESMTP id g0H2UxK09941; Thu, 17 Jan 2002 11:31:00 +0900 (JST) Received: from localhost (localhost [127.0.0.1]) by necspl.do.mms.mt.nec.co.jp (8.12.2/8.12.2) with ESMTP id g0H2UtcB058418; Thu, 17 Jan 2002 11:30:59 +0900 (JST) Date: Thu, 17 Jan 2002 11:30:55 +0900 (JST) Message-Id: <20020117.113055.130199478.y-koga@jp.FreeBSD.org> To: freebsd-security@FreeBSD.ORG Subject: at command heap corruption vuln. From: Koga Youichirou X-Mailer: Mew version 3.0.52 on Emacs 21.1 / Mule 5.0 (SAKAKI) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Debian and SuSE announced that "at" command leads into a heap corruption. Does anyone know if this problem affects FreeBSD? Debian: http://www.debian.org/security/2002/dsa-102 SuSE: http://www.linuxsecurity.com/advisories/suse_advisory-1817.html Debian's patch: http://security.debian.org/dists/stable/updates/main/source/at_3.1.8-10.1.diff.gz Debian's at seems to be same origin with FreeBSD, and free() part in this patch (about check_for_user()) is identical with FreeBSD. -- Koga, Youichirou PS There are other problems, I think creat() and open() in at.c should be exclusive. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message