From owner-freebsd-security  Thu Sep  7 14:52:49 2000
Delivered-To: freebsd-security@freebsd.org
Received: from rover.village.org (rover.village.org [204.144.255.49])
	by hub.freebsd.org (Postfix) with ESMTP
	id 8662C37B424; Thu,  7 Sep 2000 14:52:46 -0700 (PDT)
Received: from harmony.village.org (harmony.village.org [10.0.0.6])
	by rover.village.org (8.9.3/8.9.3) with ESMTP id PAA39241;
	Thu, 7 Sep 2000 15:52:45 -0600 (MDT)
	(envelope-from imp@harmony.village.org)
Received: from harmony.village.org (localhost.village.org [127.0.0.1]) by harmony.village.org (8.9.3/8.8.3) with ESMTP id PAA06531; Thu, 7 Sep 2000 15:52:35 -0600 (MDT)
Message-Id: <200009072152.PAA06531@harmony.village.org>
To: "Todd C. Miller" <Todd.Miller@courtesan.com>
Subject: Re: UNIX locale format string vulnerability (fwd) 
Cc: "Andrey A. Chernov" <ache@nagual.pp.ru>,
	Kris Kennaway <kris@FreeBSD.ORG>,
	"Vladimir Mencl, MK,     susSED" <mencl@nenya.ms.mff.cuni.cz>,
	freebsd-security@FreeBSD.ORG, security-officer@FreeBSD.ORG
In-reply-to: Your message of "Thu, 07 Sep 2000 15:50:13 MDT."
		<200009072150.e87LoDm26973@xerxes.courtesan.com> 
References: <200009072150.e87LoDm26973@xerxes.courtesan.com>  <200009072126.e87LQuE12710@xerxes.courtesan.com> <Pine.BSF.4.21.0009071356030.8316-100000@freefall.freebsd.org> <200009072126.e87LQuE12710@xerxes.courtesan.com> <200009072132.PAA06187@harmony.village.org> <20000908013556.A19114@nagual.pp.ru> <200009072140.e87Le3715994@xerxes.courtesan.com> <20000908014646.A19231@nagual.pp.ru> 
Date: Thu, 07 Sep 2000 15:52:35 -0600
From: Warner Losh <imp@village.org>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

In message <200009072150.e87LoDm26973@xerxes.courtesan.com> "Todd C. Miller" writes:
: In message <20000908014646.A19231@nagual.pp.ru>
: 	so spake "Andrey A. Chernov" (ache):
: 
: > Speaking outside of locale/nls area, 'sudo' *must* internally
: > 	setenv TERMCAP /usr/share/misc/termcap
: > too, for the same reasons. Grep 'issetugid' through libraries is your
: > friend.
: 
: That's way too platform specific; clearing TERMCAP (as well as
: TERMPATH and TERMINFO) if it begins with a '/' would make more sense.

If it has a '/' in it, don't you mean?
"../../../../../../../../../../../home/imp/bad-thing" is effectively
an absolute path.

Warner


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message