Date: Thu, 7 Sep 2000 15:26:23 -0700 (PDT) From: Kris Kennaway <kris@FreeBSD.org> To: Warner Losh <imp@village.org> Cc: "Todd C. Miller" <Todd.Miller@courtesan.com>, "Vladimir Mencl, MK, susSED" <mencl@nenya.ms.mff.cuni.cz>, freebsd-security@FreeBSD.org, security-officer@FreeBSD.org, millert@openbsd.org Subject: Re: UNIX locale format string vulnerability (fwd) Message-ID: <Pine.BSF.4.21.0009071520310.16976-100000@freefall.freebsd.org> In-Reply-To: <200009072144.PAA06367@harmony.village.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 7 Sep 2000, Warner Losh wrote:
> In message <Pine.BSF.4.21.0009071433440.16052-100000@freefall.freebsd.org> Kris Kennaway writes:
> : Now, I haven't fully explored to what extent this is possible on FreeBSD -
> : I believe the first one is a problem if sudo is used on third party
> : applications, but I'm not sure if the second one is, i.e. whether we
> : disallow use of '/' in the appropriate locale variables.
>
> We already disallow this. You can't set your lang to be
> ../../../../../../etc/master.password, for example. If the LANG
> variable has / in it, it is ignored. I think that the only one that
> needs this restriction.
I think all of the following can be pointed to arbitrary files as well
in setlocale():
"LC_ALL",
"LC_COLLATE",
"LC_CTYPE",
"LC_MONETARY",
"LC_NUMERIC",
"LC_TIME",
"LC_MESSAGES",
"LANG"
Kris
--
In God we Trust -- all others must submit an X.509 certificate.
-- Charles Forsythe <forsythe@alum.mit.edu>
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0009071520310.16976-100000>