Re: Possible bufferoverflow condition in lpr, xterm and xload

[@ (Igor Chudov @ home)]

*Unknown* wrote:
> >     I'm running XFree86 3.1.2E on a FreeBSD 2.2-960801-SNAP system...
> > ``xterm -display `perl -e "print 'abcde' x 1000, ':0';"`'' causes a
> > segfault (but doesn't drop a core).
>
> I am running XFree86 as well on a Linux 2.0.7 (redhat) system.
>
> xterm -display `perl -e "print 'a' x 2000"` caused xterm to segfault with
> no core drop (notice I left off the :0 and it segfaulted). I've tried to
> gain a root shell, but with no success so far.

By the way, it did not crash my xterm.

How about the real solution to the xterm woes:

1. Make utmp and wtmp owned by user root, group (say) acctg, and mode 664.
2. instead of setuiding xterm as root, make it setgid acctg.

This way the worst consequence of hacking xterm would be compromise of
accounting files, but not the root user.

Is there anything else that xterm needs to do as root besides updating
{w|u}tmp? I don't think so, I made a copy in mode 755 and it worked
fine with -ut option.

        - Igor.