Date: Mon, 14 Oct 1996 22:59:19 +0200 (MET DST) From: guido@gvr.win.tue.nl (Guido van Rooij) To: marcs@znep.com (Marc Slemko) Cc: security-officer@freebsd.org, freebsd-security@freebsd.org Subject: Re: bin/1805: Bug in ftpd Message-ID: <199610142059.WAA02649@gvr.win.tue.nl> In-Reply-To: <Pine.BSF.3.95.961014121116.4318C-100000@alive.ampr.ab.ca> from Marc Slemko at "Oct 14, 96 12:14:55 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
Marc Slemko wrote: > A more permanent fix to the source may be something along the lines of the > below patch (against RELENG_2_1_5_RELEASE), but there should be an > official fix out in the next little bit: > I'm not really happy with this fix as well, but it's better than nothing., The reason being that if ftp wants to dump core, it should dump core. If you prohibit this you'll never be able to debug any problems after somethuing went wrong. What should be done is make sure the buffers containing the sensitive info are cleared as soon as the info has been used. The same problem could show up with any other suid root program that reads the password databases. (if that is indeed the happening. It might also be that just the users password string is dumped only.) I'll investigate things tomorrow evening. -Guido
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199610142059.WAA02649>