Re: traceroute-4.4BSD (slack) heap overflow

[Matt Zimmerman <mdz () CSH RIT EDU>]

On Mon, Jan 08, 2001 at 11:54:41AM +0100, Olaf Kirch wrote:

>  c.   The RESOLV_HOST_CONF variable is *not* used to specifiy
>       a replacment for /etc/hosts, but for /etc/host.conf, which
>       configures the resolver. Apart from that, it's been quite a
>       while since the resolver library honored this variable in
>       setuid programs.

If only this were true ("it's been quite a while...").  glibc 2.2's resolver
honors RESOLV_HOST_CONF in setuid programs (see resolv/res_hconf.c, or just try
it).  See, for example:

http://bugs.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=81587

--
 - mdz