From owner-freebsd-security  Fri Oct 13 23:46:11 2000
Delivered-To: freebsd-security@freebsd.org
Received: from burka.carrier.kiev.ua (burka.carrier.kiev.ua [193.193.193.107])
	by hub.freebsd.org (Postfix) with ESMTP id E019D37B66E
	for <freebsd-security@FreeBSD.ORG>; Fri, 13 Oct 2000 23:46:07 -0700 (PDT)
Received: from netch@localhost
	by burka.carrier.kiev.ua  id JRS19982
	for freebsd-security@FreeBSD.ORG; Sat, 14 Oct 2000 09:46:04 +0300 (EEST)
	(envelope-from netch)
Date: Sat, 14 Oct 2000 09:46:04 +0300
From: Valentin Nechayev <netch@lucky.net>
To: freebsd-security@FreeBSD.ORG
Subject: Re: ncurses buffer overflows (fwd)
Message-ID: <20001014094604.A18459@lucky.net>
Reply-To: netch@lucky.net
References: <200010101403.e9AE3Ir08713@cwsys.cwsent.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0i
In-Reply-To: <200010101403.e9AE3Ir08713@cwsys.cwsent.com>; from Cy.Schubert@uumail.gov.bc.ca on Tue, Oct 10, 2000 at 07:02:30AM -0700
X-42: On
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

 Tue, Oct 10, 2000 at 07:02:30, Cy.Schubert wrote about "ncurses buffer overflows (fwd)": 

> For those of you who don't subscribe to BUGTRAQ, here's a heads up.

Are systat & top in 3.* vulnerable? Shall it be fixed?
systat in 3.* uses curses, but at my box exploit failed.

netch@unicorn:~>csh tmp/systat.sh
Word too long.
netch@unicorn:~>ls -l /tmp/csh
ls: /tmp/csh: No such file or directory
netch@unicorn:~>uname -mrs
FreeBSD 3.5-STABLE i386
netch@unicorn:~>fgrep FreeBSD /usr/include/sys/param.h
 * $FreeBSD: src/sys/sys/param.h,v 1.38.2.14 2000/07/12 20:37:04 asami Exp $
#undef __FreeBSD_version
#define __FreeBSD_version 350001        /* Master, propagated to newvers */


/netch


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message