From owner-freebsd-hackers Mon Sep 15 00:20:44 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.7/8.8.7) id AAA07688 for hackers-outgoing; Mon, 15 Sep 1997 00:20:44 -0700 (PDT) Received: from sax.sax.de (sax.sax.de [193.175.26.33]) by hub.freebsd.org (8.8.7/8.8.7) with SMTP id AAA07676 for ; Mon, 15 Sep 1997 00:20:40 -0700 (PDT) Received: (from uucp@localhost) by sax.sax.de (8.6.12/8.6.12-s1) with UUCP id JAA19380 for freebsd-hackers@FreeBSD.ORG; Mon, 15 Sep 1997 09:20:39 +0200 Received: (from j@localhost) by uriah.heep.sax.de (8.8.7/8.8.5) id JAA04949; Mon, 15 Sep 1997 09:02:20 +0200 (MET DST) Message-ID: <19970915090216.CL25419@uriah.heep.sax.de> Date: Mon, 15 Sep 1997 09:02:16 +0200 From: j@uriah.heep.sax.de (J Wunsch) To: freebsd-hackers@FreeBSD.ORG Subject: Re: Why SPERL? References: X-Mailer: Mutt 0.60_p2-3,5,8-9 Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Phone: +49-351-2012 669 X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F 93 21 E0 7D F9 12 D6 4E Reply-To: joerg_wunsch@uriah.heep.sax.de (Joerg Wunsch) In-Reply-To: ; from Existence is Futile on Sep 15, 1997 06:30:43 +0200 Sender: owner-freebsd-hackers@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk As Existence is Futile wrote: > Someone posted a similar message earlier, but I never saw a reply (might > have been because the mailserver for this domain is Linux.. hehe). Then you didn't read very carefully. > Why does even the latest RELENG (that I've used) include sperl4.036? Because we have fixed all known security holes. > when > it's a well known way to get root? it came in handy today when some guy > couldn't su because he wasnt in the wheel group and couldn't login as root > any other way (being 45 minutes away). But, it's a serious security flaw! j@uriah 104% make sperl cc -O2 -m486 -pipe sperl.c -o sperl j@uriah 105% ./sperl #‰^ N Can't open perl script " 1Ò‰V‰V‰VsVx1À°; ‰ÊRQSPëwèØÿÿÿ/bin/sh````aaaabbbbcccccoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿^[[?1;2cïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ïoÕ¿ï": File name too long > Of course, this may have already been fixed and I'm just blowing hot air > all around, but its an old exploit and the august releng's at least > include it. Which August? I've fixed it on August 8, 1996 (although i've missed a few function calls originally). -- cheers, J"org joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE Never trust an operating system you don't have sources for. ;-)