Re: traceroute-4.4BSD (slack) heap overflow

[Gordon Messmer <yinyang () EBURG COM>]

On Mon, 8 Jan 2001, Dale Thatcher wrote:

> On Mon, Jan 08, 2001 at 11:54:41AM +0100, Olaf Kirch wrote:
> >  c. The RESOLV_HOST_CONF variable is *not* used to specifiy
> >     a replacment for /etc/hosts, but for /etc/host.conf, which
> >     configures the resolver. Apart from that, it's been quite a
> >     while since the resolver library honored this variable in
> >     setuid programs.
>
> I just tried this on Debian unstable (libc 2.2-9) and read my /etc/shadow
>
> Whoops...

Also works on Red Hat 7.0.  I filed a bug report yesterday.
jakub () redhat com replied that new packages will be available as soon as
they're QA'd.  Afterward, I plan to personally check that all variables
that glibc uses are unset for suid apps. ;)  (I'm crazy like that...)

MSG

--
If I had a dollar for every brain that you don't have,
        I'd have one dollar. - Squidward to SpongeBob