From owner-freebsd-security Thu Sep 7 15:25: 1 2000 Delivered-To: freebsd-security@freebsd.org Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42]) by hub.freebsd.org (Postfix) with ESMTP id 4859737B422; Thu, 7 Sep 2000 15:24:55 -0700 (PDT) Received: (from ache@localhost) by nagual.pp.ru (8.11.0/8.11.0) id e87MJIg19860; Fri, 8 Sep 2000 02:19:18 +0400 (MSD) (envelope-from ache) Date: Fri, 8 Sep 2000 02:19:17 +0400 From: "Andrey A. Chernov" To: "Todd C. Miller" Cc: Warner Losh , Kris Kennaway , "Vladimir Mencl, MK, susSED" , freebsd-security@FreeBSD.ORG, security-officer@FreeBSD.ORG Subject: Re: UNIX locale format string vulnerability (fwd) Message-ID: <20000908021915.A19655@nagual.pp.ru> References: <200009072126.e87LQuE12710@xerxes.courtesan.com> <200009072126.e87LQuE12710@xerxes.courtesan.com> <200009072132.PAA06187@harmony.village.org> <20000908013556.A19114@nagual.pp.ru> <200009072140.e87Le3715994@xerxes.courtesan.com> <20000908014646.A19231@nagual.pp.ru> <200009072150.e87LoDm26973@xerxes.courtesan.com> <20000908015631.A19316@nagual.pp.ru> <200009072202.e87M2su28507@xerxes.courtesan.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <200009072202.e87M2su28507@xerxes.courtesan.com>; from Todd.Miller@courtesan.com on Thu, Sep 07, 2000 at 04:02:54PM -0600 Organization: Biomechanoid Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Thu, Sep 07, 2000 at 04:02:54PM -0600, Todd C. Miller wrote: > In message <20000908015631.A19316@nagual.pp.ru> > so spake "Andrey A. Chernov" (ache): > > > Clearing all (or resetting TERMCAP as I suggest) must be done in any case, > > not only if it begins with '/'. The reason is simple - intruder can supply > > bad entry (%-infected) directly in the TERMCAP variable. > > Sorry, I don't buy it. '%' is a perfectly fine (and common) thing > to find in a termcap entry. If you have code that behaves poorly > only termcap entries with '%' in them you've got serious problems... You'll buy it. It will be carefully choosed %p/%s combination with shell code imbedded as \xxx controls directly in termcap entry and passed to tgoto/tparm. -- Andrey A. Chernov http://ache.pp.ru/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message