OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Tomasz Kužniar (mezonPROFNET.PL)
Date: Fri Feb 02 2001 - 02:36:29 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On Wed, Jan 31, 2001 at 02:22:01PM -0000, Joao Gouveia wrote:
    : The man package that ships with SuSe Linux ( at least versions 6.1 throught
    : 7.0 ) has a format string vulnerability. Also debian 2.2r2 ( at least ), is
    : confirmed to have the same problem.
    :
    : <quote>
    : jrobertospike:~ > man -l %x%x%x%x
    : man: 4000bc7438049af00: No such file or directory
    : </quote>

    The same problem in most (all?) distributions is with m4 - GNU macro
    processor code, when trying use -G option:

    mezonbeata:~$ m4 -G %x%x%x%x
    m4: 40012a48380491e00: No such file or directory 

    --
Tomasz Kuzniar <mezonprofnet.pl>
* Polska Platforma Internetowa *
              ~ ~ ~
"Wyjsc na ludzi - Go out on people"