Vulnerability Development: Re: TCSH problems?

[Mike Duncan <duncan () randomtask net>]

Solaris 8 default tcsh install (SUNWtcshS package)

bash-2.03# tcsh
# setenv HOME `perl -e 'print "/" x 10000'`
Abort (core dumped)
bash-2.03# ls -al core
-rw-------   1 root     other     493880 Jun  6 11:48 core
bash-2.03# uname -a
SunOS unknown 5.8 Generic_108528-03 sun4m sparc SUNW,SPARCstation-4


On Wed, 6 Jun 2001, Alex wrote:

>       After some ktracing, and code auditing by myself and a colleague,
> we believe the problem *may* infact be in libc's setenv() and getenv()
> functions.  We were able to duplicate the bug on various platforms, mostly
> causing signal 6s and dumping cores.  Feedback would be appreciated
>
>
> > > setenv HOME `perl -e 'print "/" x 10000'`
>                                       ^ Length varies from 1024-10000
> for effectiveness on diffrent OSes.
>
> -Alex
-- 
------------------------------------------
Mike Duncan
security () randomtask net
http://www.randomtask.net

FLOD: The World's Perfect Cube Of Fat 
Also comes in glow-in-the-dark models. 
 ** Don't accept any imitations. **
------------------------------------------