OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Here's another glibc env. var.
From: Alan Cox (alanlxorguk.ukuu.org.uk)
Date: Wed May 24 2000 - 16:43:18 CDT

> So who can cook up something evil with LC_ALL then?

LC_* is good for app attacking.

Grep apps for

        sprintf(stackbuffer, _("foo %-85s bar"), string)

There's a lot of it about. And ignoring LC_ for setuid apps is not an option
if you wish to travel abroad and live.

Alan