Jon Ribbens wrote: > Thomas Boutell's cgic library (version 1.05) has a buffer overflow in > cgiFormEntryString() which is almost certainly exploitable. (Although > it obviously depends on the program that has linked with cgic.) Seems to be solved. From Thomas Boutells site (http://www.boutell.com/cgic/#whatsnew106) What's new in version 1.06? 1. A potentially significant buffer overflow problem has been corrected. Jon Ribbens correctly pointed out to me (and to the Internet's bugtraq mailing list) that the cgiFormEntryString function, which is used directly or indirectly by almost all CGIC programs, can potentially write past the buffer passed to it by the programmer. This bug has been corrected. Upgrading to version 1.06 is strongly recommended. 2. The function cgiSaferSystem() has been removed entirely. This function escaped only a few metacharacters, while most shells have many, and there was no way to account for the many different operating system shells that might be in use on different operating systems. Since this led to a false sense of security, the function has been removed. It is our recommendation that user input should never be passed directly on the command line unless it has been carefully shown to contain only characters regarded as safe and appropriate by the programmer. Even then, it is better to design your utilities to accept their input from standard input rather than the command line. Regards, Frank
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:37:14 PDT