Re: libresolv+ bug

[coxa () cableol net (Alan Cox)]

> In response to the libresolv+ hole ...  I'm sure there's a better/more
> encompassing/cleaner method of fixing it, but here's my patch for ping (I
> have the Netkit-B-0.07A source for ping (linux)...  It just switches the
> effective uid to nobody (default 65534) around a certain gethostbyname ...
> This fixed the problem as far as I can tell on my system...

This is not a fix for any of the libresolv++ holes. Firstly you can
use the TRIM list to overrun the trim buffer non setuid, but make the
non setuid code executed patch other parts of the binary so that when
it goes back setuid -- BLAM.

Has anyone checked if the BSD libc's are also not checking for an
overrun of the domain trimming buffer ?