Re: [8lgm]-Advisory-22.UNIX.syslog.2-Aug-1995

perrypiermont.com

• Messages sorted by: [ date ][ thread ][ subject ][ author ]
• Next message: Mark A. Fullmer: "syslog()"
• Previous message: Perry E. Metzger: "Re: Patch for 8lgm syslog/sendmail vulnerability, 4.4lite machines"
• In reply to: Mark Thomas: "[8lgm]-Advisory-22.UNIX.syslog.2-Aug-1995"

Mark Thomas writes:
> If anyone comes up with diffs to SunOS syslog() source for those
> who have source access, or a replacement syslog.c routine to build into
> libc, please post.

I've already built patches for 4.4lite BSD derived systems, which I'll
post in a little while after I've tested them better. Unfortunately,
they require the use of snprintf, which is not standard on anything
other than 4.4BSD. I can't think of any way to get around this -- you
need to bounds check the sprintfs in syslog.c and the only way I know
to do that is snprintf.

I'll point out that this opens up a whole new wonderful set of holes
that no one thought of before.

Perry

• Next message: Mark A. Fullmer: "syslog()"
• Previous message: Perry E. Metzger: "Re: Patch for 8lgm syslog/sendmail vulnerability, 4.4lite machines"
• In reply to: Mark Thomas: "[8lgm]-Advisory-22.UNIX.syslog.2-Aug-1995"