From owner-freebsd-security Wed Feb 5 22:52:29 1997 Return-Path: Received: (from root@localhost) by freefall.freebsd.org (8.8.5/8.8.5) id WAA10507 for security-outgoing; Wed, 5 Feb 1997 22:52:29 -0800 (PST) Received: from mailserv.tversu.ac.ru (mailserv.tversu.ac.ru [193.233.128.3]) by freefall.freebsd.org (8.8.5/8.8.5) with SMTP id WAA10458 for ; Wed, 5 Feb 1997 22:52:22 -0800 (PST) Received: from localhost (vadim@localhost) by mailserv.tversu.ac.ru (8.6.12/8.6.12) with SMTP id JAA00329 for ; Thu, 6 Feb 1997 09:53:30 +0300 Date: Thu, 6 Feb 1997 09:53:28 +0300 (MSK) From: Vadim Kolontsov To: freebsd-security@freebsd.org Subject: summury: holes in locale In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-security@freebsd.org X-Loop: FreeBSD.org Precedence: bulk Hello, the summary about patchkit. Patchkit must understand all versions of FreeBSD, and make a correct changes in the system. It must contain: 1) corrected /usr/lib/libc.a, libc.so.* 2) corrected /usr/lib/crt0.o 3) lfix, which patches statically linked binaries (why to patch dinamically linked bins? we already fixed this bug placing patched libc in /usr/lib, isn't it?) 4) some script, which can make all modification automatically; it must check if we are working in single-user mode (to avoid problem with running binaries) 5) good README My part of project: lfix/ltest. I have to make changes in it, because at this time lfix/ltest tested only on FreeBSD 2.1.0 (by me). Also checking for static/dyn linking can be added.. and chflag handling.. I still don't know what we need to do with statically linked binaries which calls locale stuff by itself.. may be we can patch libc, contained in binary (pattern search for _startup_locale code etc)?... of course, recompiling is the solution... Anybody knows, how many statically linked setuid binaries call locale routines by itself? (not by their C startup module) May be, we can include corrected (recompiled) versions of them into the patchkit?.. For all versions of FreeBSD? Any ideas, suggestions, volunteers?.. Best regards, Vadim. -------------------------------------------------------------------------- Vadim Kolontsov SysAdm/Programmer Tver Regional Center of New Information Technologies Networks Lab