Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 8 Sep 2000 01:46:47 +0400
From:      "Andrey A. Chernov" <ache@nagual.pp.ru>
To:        "Todd C. Miller" <Todd.Miller@courtesan.com>
Cc:        Warner Losh <imp@village.org>, Kris Kennaway <kris@FreeBSD.ORG>, "Vladimir Mencl, MK, susSED" <mencl@nenya.ms.mff.cuni.cz>, freebsd-security@FreeBSD.ORG, security-officer@FreeBSD.ORG
Subject:   Re: UNIX locale format string vulnerability (fwd)
Message-ID:  <20000908014646.A19231@nagual.pp.ru>
In-Reply-To: <200009072140.e87Le3715994@xerxes.courtesan.com>; from Todd.Miller@courtesan.com on Thu, Sep 07, 2000 at 03:40:03PM -0600
References:  <200009072126.e87LQuE12710@xerxes.courtesan.com> <Pine.BSF.4.21.0009071356030.8316-100000@freefall.freebsd.org> <200009072126.e87LQuE12710@xerxes.courtesan.com> <200009072132.PAA06187@harmony.village.org> <20000908013556.A19114@nagual.pp.ru> <200009072140.e87Le3715994@xerxes.courtesan.com>

next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Sep 07, 2000 at 03:40:03PM -0600, Todd C. Miller wrote:
> In message <20000908013556.A19114@nagual.pp.ru>
> 	so spake "Andrey A. Chernov" (ache):
> 
> > 'sudo' port *must* strip NLSPATH and PATH_LOCALE variables. No other
> > actions required.
> 
> That seems pretty reasonable.  I'll strip those out of the environment
> in sudo 1.6.4.

Speaking outside of locale/nls area, 'sudo' *must* internally
	setenv TERMCAP /usr/share/misc/termcap
too, for the same reasons. Grep 'issetugid' through libraries is your
friend.

-- 
Andrey A. Chernov
<ache@nagual.pp.ru>
http://ache.pp.ru/


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000908014646.A19231>