From owner-freebsd-security Sat Sep 12 19:53:13 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id TAA11073 for freebsd-security-outgoing; Sat, 12 Sep 1998 19:53:13 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from RWSystems.net (Commie.RWSystems.net [204.251.23.221]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id TAA11067 for ; Sat, 12 Sep 1998 19:53:12 -0700 (PDT) (envelope-from jwyatt@rwsystr.RWSystems.net) Received: from rwsystr.RWSystems.net([204.251.23.1]) (1524 bytes) by RWSystems.net via sendmail with P:smtp/R:inet_hosts/T:smtp (sender: ) id for ; Sat, 12 Sep 1998 21:30:52 -0500 (CDT) (Smail-3.2.0.101 1997-Dec-17 #1 built 1998-Jul-31) Date: Sat, 12 Sep 1998 21:29:49 -0500 (CDT) From: James Wyatt To: security@FreeBSD.ORG Subject: Re: cat exploit In-Reply-To: <19980911124430.A15005@drwho.xnet.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Fri, 11 Sep 1998, Michael Maxwell wrote: > On Thu, Sep 10, 1998 at 10:57:59AM -0700, patl@phoenix.volant.org wrote: > > No, I usually 'less', 'more', or even 'emacs' it. For two reasons. > > 1) INSTALL is usually too large to fit in a single terminal window; > > sometimes too large to fit in the default scrollbuffer. 2) It > > might contain characters that would make my terminal window do > > something I'd rather it didn't... > And another solution that has thus far been forgotten: file(1). I use this > routinely, on systems that have it, before I "cat" or "more" a file... 'file' only looks at enough of the file to characterize it and print something for the user. It catches binaries, but not someone who embedding a control char in an interactive session (chat, motd 8{), old finger, such) or somewhere down in a 'text' file. Having Who-R-You (Ctl-E) support is *very* handy, could we just make it static? Make it return 'xterm' and nothing else and it might be safe. James Wyatt (jwyatt@rwsystems.net) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message