From owner-freebsd-security  Thu Jul 19 10:19:56 2001
Delivered-To: freebsd-security@freebsd.org
Received: from assaris.sics.se (assaris.sics.se [193.10.66.234])
	by hub.freebsd.org (Postfix) with ESMTP
	id 23C4237B403; Thu, 19 Jul 2001 10:19:53 -0700 (PDT)
	(envelope-from assar@assaris.sics.se)
Received: (from assar@localhost)
	by assaris.sics.se (8.9.3/8.9.3) id TAA15011;
	Thu, 19 Jul 2001 19:20:10 +0200 (CEST)
	(envelope-from assar)
To: Ruslan Ermilov <ru@FreeBSD.ORG>
Cc: "Jacques A. Vidrine" <n@nectar.com>,
	Matt Dillon <dillon@earth.backplane.com>,
	Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>,
	Mike Tancsa <mike@sentex.net>, Kris Kennaway <kris@obsecurity.org>,
	security@FreeBSD.ORG
Subject: Re: FreeBSD remote root exploit ?
References: <200107190547.f6J5lmD66188@cwsys.cwsent.com> <200107190747.f6J7lMU71487@earth.backplane.com> <20010719102230.L27900@madman.nectar.com> <5lpuaw26kt.fsf@assaris.sics.se> <20010719201009.A61061@sunbay.com>
From: Assar Westerlund <assar@FreeBSD.ORG>
Date: 19 Jul 2001 19:20:10 +0200
In-Reply-To: Ruslan Ermilov's message of "Thu, 19 Jul 2001 20:10:09 +0300"
Message-ID: <5l8zhk25v9.fsf@assaris.sics.se>
Lines: 9
User-Agent: Gnus/5.070098 (Pterodactyl Gnus v0.98) Emacs/20.6
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Ruslan Ermilov <ru@FreeBSD.ORG> writes:
> > I don't know if it's exploitable either.  I don't _think_ so, but I've
> > of course fixed the problem anyways.
> > 
> You mean, in netflush()?

No, in output_data() (in heimdal's telnetd/global.c)

/assar

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message