Vulnerability Development: Re: Possible syslogd DoS ?

[Tim Walberg <twalberg () mindspring com>]

On 10/05/2001 11:28 -0500, H D Moore wrote:
> >      Are you sure tha /dev/urandom will never return a string with %[snpfdn] etc? 
> >      Your exploit may be exploitable ;)
> >      
> >      On Friday 05 October 2001 12:19 am, Petr Baudis wrote:
> >      >
> >      >   for(;;)
> >      >   {
> >      >     fgets(buffer, sizeof(buffer), fp);
> >      >     syslog(0, buffer);
> >      >   }
> >      
> >      Fix: syslog(0, "%s", buffer);
> >      
> >      -- 
> >      H D Moore
> >      http://www.digitaldefense.net - work
> >      http://www.digitaloffense.net - play
End of included message

Another fix, althought the point of the program
is well demonstrated without it:

for(;;)
{
  fgets(buffer, sizeof(buffer), fp);
  buffer[1023] = 0;
  syslog(0, "%s", buffer);
}




-- 
twalberg () mindspring com

Attachment: _bin
Description: