Re: FreeBSD (and other BSDs?) local root explot

From: Charles M. Hannum (rootat_private)
Date: Fri Sep 03 1999 - 09:06:15 PDT

  • Next message: Gary McGraw: "Internet Gambling Exploit"

    As of yesterday, the OpenBSD version of fts.c was still susceptible to
    at least two bugs that can cause a core dump when FTS_NOCHDIR is used
    (e.g. by pax(1)).  Beware if you do backups with pax(1)!
    
    These problems, and others, are fixed in the current NetBSD version.
    
    revision 1.20
    date: 1999/08/27 18:01:35;  author: mycroft;  state: Exp;  lines: +16 -10
    Fix multiple problems in the FTS_NOCHDIR case:
    * There was an off-by-one error that caused the addition of a NUL or
      slash in fts_build() to overwrite other memory.
    * After fts_palloc(), we need to reset `cp' so that it points to the
      new path name buffer; otherwise the addition of the file name before
      calling fts_stat() could lose.
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:01:46 PDT