Re: [External] : [oss-security] Buffer overflow in /bin/su from UNIX v4

[Casper Dik <casper.dik () oracle com>]

I believe the bug in su was found earlier; I remember that if you type a password and follow it with the encrypted 
password, you would get in.  Looking at the code, you'd need to make sure that the encrypted password of the password 
you just typed in would need to be at position 105 (100+"root:")

Casper

________________________________________
From: Alan Coopersmith <alan.coopersmith () oracle com>
Sent: 05 January 2026 18:27
To: oss-security () lists openwall com
Subject: [External] : [oss-security] Buffer overflow in /bin/su from UNIX v4

Late last year, a tape was found containing the only known copy of Bell Labs
Research Unix Version 4 from 1973 - the version in which UNIX was rewritten
from assembly into the then-new C programming language.  Since then a number
of folks have been running the recovered software in PDP-11 simulators.

https://urldefense.com/v3/__https://sigma-star.at/blog/2025/12/unix-v4-buffer-overflow/__;!!ACWV5N9M2RV99hQ!Px94aM2iBzLwDRhX4zhSX89cVDosduXv7mNqmv7HMgwJHi_4FhtNHHhlzrhKONdsG8YQvXzRqmsruAgbbj_wwY8jw3A$
  examines the
source code for su.c and shows that the buffer for password input is a
simple 100 character array, but the loop to read password input has no
boundary checks and will happily keep writing long past the end of the
buffer.

Doug McIlroy from the original Bell Labs Unix team points out that
"Overflowable buffers were common in those days." and that there are
likely more to be found in the UNIX v4 source code, in the thread at
https://urldefense.com/v3/__https://www.tuhs.org/pipermail/tuhs/2026-January/032966.html__;!!ACWV5N9M2RV99hQ!Px94aM2iBzLwDRhX4zhSX89cVDosduXv7mNqmv7HMgwJHi_4FhtNHHhlzrhKONdsG8YQvXzRqmsruAgbbj_wKopG4mw$

--
         -Alan Coopersmith-                 alan.coopersmith () oracle com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris