From owner-freebsd-security Thu Sep 7 15: 4:10 2000 Delivered-To: freebsd-security@freebsd.org Received: from xerxes.courtesan.com (64-6-178-150.den1.phoenixdsl.net [64.6.178.150]) by hub.freebsd.org (Postfix) with ESMTP id 93AC637B422; Thu, 7 Sep 2000 15:04:05 -0700 (PDT) Received: from xerxes.courtesan.com (millert@localhost) by xerxes.courtesan.com (8.10.1/8.10.1) with ESMTP id e87M2su28507; Thu, 7 Sep 2000 16:02:54 -0600 (MDT) Message-Id: <200009072202.e87M2su28507@xerxes.courtesan.com> To: "Andrey A. Chernov" Cc: "Todd C. Miller" , Warner Losh , Kris Kennaway , "Vladimir Mencl, MK, susSED" , freebsd-security@FreeBSD.ORG, security-officer@FreeBSD.ORG Subject: Re: UNIX locale format string vulnerability (fwd) In-reply-to: Your message of "Fri, 08 Sep 2000 01:56:34 +0400." <20000908015631.A19316@nagual.pp.ru> References: <200009072126.e87LQuE12710@xerxes.courtesan.com> <200009072126.e87LQuE12710@xerxes.courtesan.com> <200009072132.PAA06187@harmony.village.org> <20000908013556.A19114@nagual.pp.ru> <200009072140.e87Le3715994@xerxes.courtesan.com> <20000908014646.A19231@nagual.pp.ru> <200009072150.e87LoDm26973@xerxes.courtesan.com> <20000908015631.A19316@nagual.pp.ru> Date: Thu, 07 Sep 2000 16:02:54 -0600 From: "Todd C. Miller" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org In message <20000908015631.A19316@nagual.pp.ru> so spake "Andrey A. Chernov" (ache): > Clearing all (or resetting TERMCAP as I suggest) must be done in any case, > not only if it begins with '/'. The reason is simple - intruder can supply > bad entry (%-infected) directly in the TERMCAP variable. Sorry, I don't buy it. '%' is a perfectly fine (and common) thing to find in a termcap entry. If you have code that behaves poorly only termcap entries with '%' in them you've got serious problems... - todd To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message