From owner-freebsd-security Thu Sep 10 15:31:24 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id PAA14829 for freebsd-security-outgoing; Thu, 10 Sep 1998 15:31:24 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from stage1.thirdage.com (stage1.ThirdAge.com [204.74.82.151]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id PAA14822 for ; Thu, 10 Sep 1998 15:31:22 -0700 (PDT) (envelope-from jal@ThirdAge.com) Received: from gigi (gigi.ThirdAge.com [204.74.82.169]) by stage1.thirdage.com (8.8.5/8.8.5) with SMTP id PAA18852; Thu, 10 Sep 1998 15:26:55 -0700 (PDT) Message-Id: <3.0.5.32.19980910153036.00ce92a0@204.74.82.151> X-Sender: jal@204.74.82.151 X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32) Date: Thu, 10 Sep 1998 15:30:36 -0700 To: Aleph One From: Jamie Lawrence Subject: Re: cat exploit Cc: security@FreeBSD.ORG In-Reply-To: References: <3.0.5.32.19980910144756.01d24c70@204.74.82.151> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org [My last comment on the topic.] >The problem may be as old as unix itself. Nonetheless, it hasnt been >fixed. Fixing it in cat, by not using it or modiying it, is the wrong >solution. Nor is this a root only problem. You an I may know not to use >cat, but what about all your users? Nor is cat the only way to display >files. The correct solution is to fix terminal emulators to ignore >dangerous escape characters. The fact of the matter is that this is defined behaviour. cat by default sends input to the terminal. The terminal processes certain input in certain ways. 'Fixing' terms would break an installed base of tools that use those escape characters. Perhaps processing escapes was a bad design idea - I certainly won't try to defend it from a security standpoint. But breaking a ton of tools to fix a different set is not a workable solution. As far as "what about the users" goes, I know of no way to save them from all the ways they can shoot themselves in the foot, save disabling a majority of the supplied OS utilities. I disagree that 'fixing' the terminals is the correct solution, even if they can be 'fixed' to provide the desired results without breaking compatibility (which I don't believe is possible, but then I haven't investigated it). From a security standpoint, it _might_ be, in some contexts. I find it odd that this one is suddenly getting so much attention suddenly. Nature of mailing lists, I suppose. -j To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message