From owner-freebsd-security Thu Sep 10 17:33:17 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id RAA06252 for freebsd-security-outgoing; Thu, 10 Sep 1998 17:33:17 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from hyperreal.org (taz.hyperreal.org [209.133.83.16]) by hub.freebsd.org (8.8.8/8.8.8) with SMTP id RAA06243 for ; Thu, 10 Sep 1998 17:33:16 -0700 (PDT) (envelope-from brian@hyperreal.org) Received: (qmail 3456 invoked by uid 24); 11 Sep 1998 00:33:06 -0000 Message-ID: <19980911003306.3455.qmail@hyperreal.org> X-Sender: brian@hyperreal.org X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0.1 Date: Thu, 10 Sep 1998 17:33:41 -0700 To: andrew@squiz.co.nz From: Brian Behlendorf Subject: Re: terminal escape exploit (was Re: cat exploit) Cc: security@FreeBSD.ORG In-Reply-To: References: <35F818CA.8647A116@dal.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org At 09:19 AM 9/11/98 +1200, Andrew McNaughton wrote: >On Thu, 10 Sep 1998, Studded wrote: > >> It seems to me that a lot of people missed the point of one of the >> warnings that someone else posted in response actually. Don't use cat >> routinely to view files. Use more, or better yet less since less doesn't >> view binary files by default. > >It's not just cat that you've got to worry about. tail is another one. >How many people routinely use 'tail -f' to monitor log info that includes >potentially tainted content. Yeah, especially when trying to debug a problem that requires root. I do this. >The problem is not cat. It's xterm and other similar terminal programs. I agree. Even if the old-timers around here are saying "it's always been like that, just don't do it and it'll be all OK", I still see this as a design flaw, and would like to believe that "running arbitrary commands" can be prevented without preventing all the legitimate uses for escape sequences. Brian --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-- "Common sense is the collection of prejudices | brian@apache.org acquired by the age of eighteen." - Einstein | brian@hyperreal.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message