OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 1st quarter (Jan-Mar) 1995: Re: bsd in.talkd+antiflash remote-remote hole

Re: bsd in.talkd+antiflash remote-remote hole

Leo Bicknell (bicknellussenterprise.async.vt.edu)
Fri, 10 Mar 1995 13:11:44 -0500 (EST) 

> Modify your DNS hostfield to :
> 
> 	;any_command_you_want
> 
> Set a talk flash to the site running the in.talkd d, and guess what happens?

	Flash is such a wonderful tool.  I submitted a patch to the
NetBSD people which got forwarded to some of the BSD (4.4lite?)
people.  I'm not sure what it's in.  Basically I added a check to make
sure each charactor in whatever the other end gave us "isprint()"able,
and if it's not turn it into a space.  This removes the ESC charactor
from flash strings, rendering flash usless.

	When you get data from a possibly untrustworthy source you
need to be careful about what you do with it.

-- 
Leo Bicknell - bicknellvt.edu                     | Make a little birdhouse
               bicknellcsugrad.cs.vt.edu          | in your soul......
               bicknellussenterprise.async.vt.edu | They Might
http://ussenterprise.async.vt.edu/~bicknell/       | Be Giants