Re: ISS Internet Scanner Brute Force Bug

From: David LeBlanc (dleblancat_private)
Date: Fri Feb 19 1999 - 06:52:20 PST

  • Next message: CyberPsychotic: "Re: Pro/wuFTPD DoS"

    At 10:18 AM 2/19/99 -0000, Stephen Bishop wrote:
    >David,
    
    >> I'd suggest that you use vi, notepad, or some reasonable
    >> text editor in the meantime.  Just what text editor are you using?
    
    >At the risk of getting off the subject, I've come across many situations
    where
    >having the last line in a file without a line terminator has caused problems,
    >so I think software should always be written to handle this situation. And
    >even Emacs (which, otherwise, solves all life's problems) allows me to create
    >a file with no line terminator at the end.
    
    I agree.  I thought the same thing when I fixed this a long time ago.  I
    looked at the code last night, and it looks like it is handling this
    situation just fine.  Since the bug does appear to be in recent builds
    (somehow), the work-around would be to place either a blank line or a
    comment (start the line with #) as the last line.  Or simply hit the enter
    key at the end of each line.
    
    My version of vi does not allow this, hmmm - checking a few others...
    
    Here's what I've found:
    Terminates all lines:
    vi (Congruent GNU port from ftp.cc.utexas - actually elvis)
    Word
    Wordpad
    edit
    edlin (and adds a ^Z)
    
    Does NOT terminate:
    notepad
    copy con [file]
    VC++ text editor
    
    <joke> Moral of story - always use vi, and life is good 8-)
    
    BTW, as a pre-emptive strike against this one, there _is_ a bug in the NT
    scanner where we're not handling LF-delimited files properly.  If you
    happen to have created your user-password pairs under UNIX, run tr on the
    file before using it in the scanner.  Alternately, open it in Word and save
    it back out. Notepad will NOT help - it doesn't deal with LF-delimited
    files correctly either.  NT's version of perl also makes this easy -
    running the following script does it:
    
    while(<>){print;}
    
    
    David LeBlanc
    dleblancat_private
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:35:59 PDT