From owner-freebsd-security  Thu Sep  7 15:34:36 2000
Delivered-To: freebsd-security@freebsd.org
Received: from rover.village.org (rover.village.org [204.144.255.49])
	by hub.freebsd.org (Postfix) with ESMTP
	id 0F10837B422; Thu,  7 Sep 2000 15:34:31 -0700 (PDT)
Received: from harmony.village.org (harmony.village.org [10.0.0.6])
	by rover.village.org (8.9.3/8.9.3) with ESMTP id QAA39590;
	Thu, 7 Sep 2000 16:34:27 -0600 (MDT)
	(envelope-from imp@harmony.village.org)
Received: from harmony.village.org (localhost.village.org [127.0.0.1]) by harmony.village.org (8.9.3/8.8.3) with ESMTP id QAA07199; Thu, 7 Sep 2000 16:34:17 -0600 (MDT)
Message-Id: <200009072234.QAA07199@harmony.village.org>
To: Kris Kennaway <kris@FreeBSD.org>
Subject: Re: UNIX locale format string vulnerability (fwd) 
Cc: "Todd C. Miller" <Todd.Miller@courtesan.com>,
	"Vladimir Mencl, MK,     susSED" <mencl@nenya.ms.mff.cuni.cz>,
	freebsd-security@FreeBSD.org, security-officer@FreeBSD.org,
	millert@openbsd.org
In-reply-to: Your message of "Thu, 07 Sep 2000 15:32:42 PDT."
		<Pine.BSF.4.21.0009071532190.25298-100000@freefall.freebsd.org> 
References: <Pine.BSF.4.21.0009071532190.25298-100000@freefall.freebsd.org>  
Date: Thu, 07 Sep 2000 16:34:17 -0600
From: Warner Losh <imp@village.org>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

In message <Pine.BSF.4.21.0009071532190.25298-100000@freefall.freebsd.org> Kris Kennaway writes:
: On Thu, 7 Sep 2000, Warner Losh wrote:
: 
: > In message <Pine.BSF.4.21.0009071520310.16976-100000@freefall.freebsd.org> Kris Kennaway writes:
: > : I think all of the following can be pointed to arbitrary files as well
: > : in setlocale():
: > :     "LANG"
: > 
: > LANG cannot.  If it contains /, it is ignored.
: 
: setlocale(), not catopen(). It is treated on the same footing as all of
: the others, there.

Ah, it shouldn't :-)

Warner


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message