Date: Sun, 5 May 2002 19:46:43 -0400 From: Anthony Schneider <aschneid@mail.slc.edu> To: Colin Percival <colin.percival@wadham.ox.ac.uk> Cc: ReDeeMeR <g0tr00t@usa.net>, FreeBSD-security@FreeBSD.ORG Subject: Re: Buffer overflow in /usr/games/strfile Message-ID: <20020505194643.A934@mail.slc.edu> In-Reply-To: <5.0.2.1.1.20020505224651.00afbd78@popserver.sfu.ca>; from colin.percival@wadham.ox.ac.uk on Sun, May 05, 2002 at 11:27:49PM %2B0100 References: <20020505213314.8762.qmail@uwdvg007.cms.usa.net> <5.0.2.1.1.20020505224651.00afbd78@popserver.sfu.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
--TB36FDmn/VVEgNH/
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Sun, May 05, 2002 at 11:27:49PM +0100, Colin Percival wrote:
> Given that this is not a security issue -- as you point out, "no extra=
=20
> privileges can be gained" -- this is rather off-topic for -security;=20
> nevertheless, it is less so than discussions of mailing list sender=20
> restrictions, so I'll go ahead and respond.
I agree that it is not an *active* security hazard, however, it is a
potential security hazard were some other extra-privileged program to rely
on strfile's functionality for whatever purpose (think termcap buffer
overflows...termcap itself, a library, is not a setuid application, but
xterm, which runs setuid root, replies on termcap, and buffer overflows
have occurred where a user crafts a malicious termcap file and launches
xterm, overflowing a buffer in some termcap routine, and getting dropped
to a shell with the same privileges that xterm was run under).
/$.02
-Anthony.
-----------------------------------------------
PGP key at:
http://www.keyserver.net/
http://www.anthonydotcom.com/gpgkey/key.txt
Home:
http://www.anthonydotcom.com
-----------------------------------------------
--TB36FDmn/VVEgNH/
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org
iEYEARECAAYFAjzVxGMACgkQ+rDjkNht5F1MqACeIjkLhrkRy02TWjq0690VWXct
/78AnjtsFBR7qtpc/4t4Eg0bOA5Vx57B
=xgwR
-----END PGP SIGNATURE-----
--TB36FDmn/VVEgNH/--
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020505194643.A934>