From owner-freebsd-security  Mon Dec  9 16:02:40 1996
Return-Path: <owner-security>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.4/8.8.4) id QAA16501
          for security-outgoing; Mon, 9 Dec 1996 16:02:40 -0800 (PST)
Received: from irbs.irbs.com (jc@irbs.irbs.com [199.182.75.129])
          by freefall.freebsd.org (8.8.4/8.8.4) with ESMTP id QAA16490
          for <freebsd-security@freebsd.org>; Mon, 9 Dec 1996 16:02:36 -0800 (PST)
Received: (from jc@localhost)
          by irbs.irbs.com (8.8.4/8.8.4)
	  id TAA14112; Mon, 9 Dec 1996 19:02:32 -0500 (EST)
Message-ID: <Mutt.19961209190230.jc@irbs.com>
Date: Mon, 9 Dec 1996 19:02:30 -0500
From: jc@irbs.com (John Capo)
To: freebsd-security@freebsd.org
Subject: Re: L0pht Advisory: modstat (fwd)
References: <Pine.BSF.3.95.961209144650.15881A-100000@orion.webspan.net>
X-Mailer: Mutt 0.51
Mime-Version: 1.0
X-Organization: IRBS Engineering, (954) 792-9551
In-Reply-To: <Pine.BSF.3.95.961209144650.15881A-100000@orion.webspan.net>; from Scanner on Dec 9, 1996 14:48:35 -0500
Sender: owner-security@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk


Modstat does not need to be setgid kmem.  Perhaps this is left over
from when groveled around in /dev/kmem.

Index: Makefile
===================================================================
RCS file: /usr/cvs/src/usr.bin/modstat/Makefile,v
retrieving revision 1.1.6.2
diff -u -r1.1.6.2 Makefile
--- Makefile	1996/06/05 02:57:14	1.1.6.2
+++ Makefile	1996/12/09 22:28:01
@@ -38,7 +38,7 @@
 
 PROG=	modstat
 MAN8=	modstat.8
-BINGRP=	kmem
-BINMODE=2555
+BINGRP=	bin
+BINMODE=555
 
 .include <bsd.prog.mk>
Index: modstat.c
===================================================================
RCS file: /usr/cvs/src/usr.bin/modstat/modstat.c,v
retrieving revision 1.3
diff -u -r1.3 modstat.c
--- modstat.c	1995/04/20 05:08:53	1.3
+++ modstat.c	1996/12/09 23:53:54
@@ -72,8 +72,9 @@
 {
 	struct lmc_stat	sbuf;
 
+	bzero(&sbuf, sizeof (sbuf));
 	if (modname != NULL)
-		strcpy(sbuf.name, modname);
+		strncpy(sbuf.name, modname, sizeof (sbuf.name) - 1);
 
 	sbuf.id = modnum;