Bugtraq: Re: Wall and talkd pass binary data

[fcp () nuance com (Craig Presson)]

In <9407200202.AA16064 () swap Eng Sun COM>, Bob Page writes:
> Wow -- this was an old haq from years and years ago.  It was first
> exploited by finger (putting escape sequences in your .plan).
(Wavy time-travel effect) DG's Dasher terminals had a set cursor
position (^P <byte> <byte>) and read-out cursor position (^E) which
could be combined using an AOS CLI SEND command and the [!ASCII]
pseudo-macro to crash another user's terminal session:

SEND @con27 Die! Die! Die! [!ASCII 20 3 2 5]

(octal 20 3 2 5 == ^P ^C ^B ^E, where ^C ^B was the code to kill
the process associated with the terminal)

If you got a terminal into binary mode you could make the line go
catatonic with ^P ^E ^E ^E ...

And, yes, DG eventually had to filter out certain control characters
to spoil the fun.


-- cP