Home page logo

bugtraq logo Bugtraq mailing list archives

Re: Security problem in C news and INN
From: rafi () tavor openu ac il (Rafi Sadowsky)
Date: Sun, 27 Feb 1994 08:54:53 +0200 (IST)

Robert Crowe wrote:

In message <199402261422.AA03742 () tavor openu ac il>, Rafi Sadowsky writes:
Jeroen Scheerder wrote:
now on BSD/386 for example /usr/bin/mail is the ucb one - which is probably
where the hole comes from ?

I just tested it under NetBSD, which I would suppose also has the ucb one,
and the tilda escapes are *not* processed for non-interactive mailings.  I
feel this is also very likely the case with BSD/386 (I can't test that until
next week sometime).

superficial testing indicates you're right

however Henry Spencer did say that on some systems it does happen
I'm glad I don't have any (I think :-)


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]