From owner-freebsd-security Thu Sep 7 15:47:14 2000 Delivered-To: freebsd-security@freebsd.org Received: from rover.village.org (rover.village.org [204.144.255.49]) by hub.freebsd.org (Postfix) with ESMTP id A5AC937B422; Thu, 7 Sep 2000 15:47:08 -0700 (PDT) Received: from harmony.village.org (harmony.village.org [10.0.0.6]) by rover.village.org (8.9.3/8.9.3) with ESMTP id QAA39652; Thu, 7 Sep 2000 16:47:04 -0600 (MDT) (envelope-from imp@harmony.village.org) Received: from harmony.village.org (localhost.village.org [127.0.0.1]) by harmony.village.org (8.9.3/8.8.3) with ESMTP id QAA07311; Thu, 7 Sep 2000 16:46:55 -0600 (MDT) Message-Id: <200009072246.QAA07311@harmony.village.org> Subject: Re: UNIX locale format string vulnerability (fwd) Cc: Kris Kennaway , "Todd C. Miller" , "Vladimir Mencl, MK, susSED" , freebsd-security@FreeBSD.org, security-officer@FreeBSD.org, millert@openbsd.org In-reply-to: Your message of "Thu, 07 Sep 2000 16:34:17 MDT." <200009072234.QAA07199@harmony.village.org> References: <200009072234.QAA07199@harmony.village.org> Date: Thu, 07 Sep 2000 16:46:55 -0600 From: Warner Losh Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org In message <200009072234.QAA07199@harmony.village.org> Warner Losh writes: : : setlocale(), not catopen(). It is treated on the same footing as all of : : the others, there. : : Ah, it shouldn't :-) Index: setlocale.c =================================================================== RCS file: /home/imp/FreeBSD/CVS/src/lib/libc/locale/setlocale.c,v retrieving revision 1.27 diff -u -r1.27 setlocale.c --- setlocale.c 2000/09/04 03:43:24 1.27 +++ setlocale.c 2000/09/07 22:34:42 @@ -129,7 +129,7 @@ if (!env || !*env) env = getenv("LANG"); - if (!env || !*env) + if (!env || !*env || strchr(env, '/')) env = "C"; (void) strncpy(new_categories[category], env, ENCODING_LEN); To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message