Date: Mon, 14 Oct 1996 18:01:15 -0700 From: Don Lewis <Don.Lewis@tsc.tdk.com> To: guido@gvr.win.tue.nl (Guido van Rooij), marcs@znep.com (Marc Slemko) Cc: security-officer@freebsd.org, freebsd-security@freebsd.org Subject: Re: bin/1805: Bug in ftpd Message-ID: <199610150101.SAA08402@salsa.gv.ssi1.com> In-Reply-To: guido@gvr.win.tue.nl (Guido van Rooij) "Re: bin/1805: Bug in ftpd" (Oct 14, 10:59pm)
next in thread | raw e-mail | index | archive | help
On Oct 14, 10:59pm, Guido van Rooij wrote: } Subject: Re: bin/1805: Bug in ftpd } Marc Slemko wrote: } > A more permanent fix to the source may be something along the lines of the } > below patch (against RELENG_2_1_5_RELEASE), but there should be an } > official fix out in the next little bit: } > } } I'm not really happy with this fix as well, but it's better than nothing., But not much ... There's nothing stopping someone to attaching to the process with the debugger and dumping out the locations in memory that contain the secret stuff. } The reason being that if ftp wants to dump core, it should dump core. } If you prohibit this you'll never be able to debug any problems after } somethuing went wrong. What should be done is make sure the buffers containing } the sensitive info are cleared as soon as the info has been used. Yes, it is important that any copies of this information are destroyed before the process changes its uid. --- Truck
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199610150101.SAA08402>