Re: Buffer overflow in /bin/su from UNIX v4

[Justin Swartz <justin.swartz () risingedge co za>]

Sat, 21 Mar 2026 19:00:13 +0100, Solar Designer wrote: 
> On Sat, Mar 21, 2026 at 01:13:47PM -0400, kf503bla ()    k com wrote:
> > why assign cve to something irrelvent?
>
> I guess because (ir)relevance isn't among criteria for (not) assigning a
> CVE, and because there may be value in having a non-ambiguous way to
> refer to historical vulnerabilities for illustration of how the current
> ones fit in historical context.

Beyond the historical context, there is an argument to be made
for being aware of known defects in legacy codebases which have
been resurrected for use on modern resource-constrained hardware.

For example, the RetroBSD [1] project provides a port of 2.11BSD
intended for PIC32 (MIPS) targets. There's also an actively
maintained RetroBSD fork, called DiscoBSD [2], which adds support
for STM32F4 (ARM Cortex-M4) targets and had its last release [3]
last month.

And then there's Serge Vakulenko's LiteBSD [4], a 4.4BSD port to
PIC32.

And who knows where Robert Nordier's port of UNIX V7, v7/x86 [5],
may be running?

While these projects might modernize parts of the kernel and/or
userland, there's always the possibility of bug-ridden code (and
bug-ridden assumptions) being inherited from their respective BSD
and/or Research UNIX lineage - as we've all seen with BSD derived
telnet server and client implementations recently.

Regards,
Justin


--- Links ---

[1] https://retrobsd.org
[2] http://discobsd.org
[3] https://github.com/chettrick/discobsd/releases/tag/DISCOBSD_2_6
[4] https://github.com/sergev/LiteBSD
[5] https://www.nordier.com/#v7x86