From owner-freebsd-hackers  Wed Aug  5 08:09:13 1998
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id IAA28714
          for freebsd-hackers-outgoing; Wed, 5 Aug 1998 08:09:13 -0700 (PDT)
          (envelope-from owner-freebsd-hackers@FreeBSD.ORG)
Received: from plains.NoDak.edu (plains.NoDak.edu [134.129.111.64])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id IAA28701
          for <freebsd-hackers@freebsd.org>; Wed, 5 Aug 1998 08:09:08 -0700 (PDT)
          (envelope-from tinguely@plains.NoDak.edu)
Received: (from tinguely@localhost)
	by plains.NoDak.edu (8.8.8/8.8.8) id KAA01192
	for freebsd-hackers@freebsd.org; Wed, 5 Aug 1998 10:08:54 -0500 (CDT)
Date: Wed, 5 Aug 1998 10:08:54 -0500 (CDT)
From: Mark Tinguely <tinguely@plains.NoDak.edu>
Message-Id: <199808051508.KAA01192@plains.NoDak.edu>
To: freebsd-hackers@FreeBSD.ORG
Subject: 2.2.7 rsh serious problem
Sender: owner-freebsd-hackers@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG


serge@oneway.net was asking a remote tar/tape backup question that
was not working, I found that 2.2.7 has a problem with rsh/rshd.
to verify:

	rsh 2.2.7HOST /etc/rmt
	rsh 2.2.7HOST /bin/cat
	rsh 2.2.7HOST /bin/sh
	rsh 2.2.7HOST dd ...

basically any remote shell that can accept more input.
	

looking at 2.2.6 and 2.2.7 rshd.c, I found the problem on line 307
in the function doit():

		int s = rresvport(&lport);

should read:

		s = rresvport(&lport);

because we later use the socket and the extra "int" makes the above
side affect only local to the for loop.

I will send a bug report, but I am sending this to hackers because it
will be a big potential problem that I thought everyone would want to
be aware of the problem.

--mark.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message