Vulnerability Development mailing list archives

Re: TCSH problems?


From: Flux9 <flux9 () 101freeway net>
Date: Wed, 06 Jun 2001 08:27:46 +0000

Alex wrote:

        After some ktracing, and code auditing by myself and a colleague,
we believe the problem *may* infact be in libc's setenv() and getenv()
functions.  We were able to duplicate the bug on various platforms, mostly
causing signal 6s and dumping cores.  Feedback would be appreciated

setenv HOME `perl -e 'print "/" x 10000'`

                                        ^ Length varies from 1024-10000
for effectiveness on diffrent OSes.

-Alex

check this out:

(slackware 7.1, tcsh 6.09)

read(3, "/////////////////////////////////" ..., 1024) = 784

After looking at strace results, it appears as the excess char's blow out
that
buffer (1024 bytes), but the actual abort results from massive forking of
children after this buffer is blown, not the buffer itself. who knows.


Current thread: