beep infoleak

[Hanno Böck <hanno () hboeck de>]

Hi,

It's been found that beep - even after the fix for "holey beep" - can
be used to create an infoleak and to see which files exist with root
permissions:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895115

Also there are Integer Overflows:
https://github.com/johnath/beep/issues/13

Also Sebastian Krahmer pointed out the fix is incomplete:
http://seclists.org/oss-sec/2018/q2/17

All of that without an existing upstream.

I question whether beep should be saved. It would require someone
carefully reviewing the code and effectively become the new upstream.
And all that for a tool talking to the PC speaker, which doesn't exist
in most modern systems anyway. Instead distros should consider not
installing it as suid or just killing the package altogether.
I heard some distros (suse) replace beep with a simple "printf '\a'"
which seems also a safe solution. (although it obviously kills all
frequency/length/etc features of original "beep").

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno () hboeck de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42