Re: bsd in.talkd+antiflash remote-remote hole

[bicknell () ussenterprise async vt edu (Leo Bicknell)]

> Modify your DNS hostfield to :
>
>       ;any_command_you_want
>
> Set a talk flash to the site running the in.talkd d, and guess what happens?

        Flash is such a wonderful tool.  I submitted a patch to the
NetBSD people which got forwarded to some of the BSD (4.4lite?)
people.  I'm not sure what it's in.  Basically I added a check to make
sure each charactor in whatever the other end gave us "isprint()"able,
and if it's not turn it into a space.  This removes the ESC charactor
from flash strings, rendering flash usless.

        When you get data from a possibly untrustworthy source you
need to be careful about what you do with it.

-- 
Leo Bicknell - bicknell () vt edu                     | Make a little birdhouse
               bicknell () csugrad cs vt edu          | in your soul......
               bicknell () ussenterprise async vt edu | They Might
http://ussenterprise.async.vt.edu/~bicknell/       | Be Giants