Vulnerability Development: Re: TCSH problems?

[Flux9 <flux9 () 101freeway net>]

Alex wrote:

>         After some ktracing, and code auditing by myself and a colleague,
> we believe the problem *may* infact be in libc's setenv() and getenv()
> functions.  We were able to duplicate the bug on various platforms, mostly
> causing signal 6s and dumping cores.  Feedback would be appreciated
>
> > > setenv HOME `perl -e 'print "/" x 10000'`
>                                         ^ Length varies from 1024-10000
> for effectiveness on diffrent OSes.
>
> -Alex
check this out:

(slackware 7.1, tcsh 6.09)

read(3, "/////////////////////////////////" ..., 1024) = 784

After looking at strace results, it appears as the excess char's blow out
that
buffer (1024 bytes), but the actual abort results from massive forking of
children after this buffer is blown, not the buffer itself. who knows.