Date: Wed, 21 May 1997 11:55:47 +0100 From: gjm11@dpmms.cam.ac.uk To: FreeBSD-gnats-submit@FreeBSD.ORG Subject: ports/3649: xlock quits on receipt of signalxx 8 Message-ID: <E0wU93b-0001Kt-00@g.pet.cam.ac.uk> Resent-Message-ID: <199705211100.EAA04011@hub.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 3649 >Category: ports >Synopsis: xlock quits on receipt of signalxx 8 >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-ports >State: open >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed May 21 04:00:01 PDT 1997 >Last-Modified: >Originator: Gareth McCaughan >Organization: all too little >Release: FreeBSD 2.2-RELEASE i386 >Environment: FreeBSD 2.2, X11R6.3 (XFree86 release 3.2A), xlockmore 3.13 >Description: When xlock receives a signal, it exits. This is a security hole; if you're running on dodgy hardware or there's a bug in the code, the terminal can become unlocked. >How-To-Repeat: Run xlock and arrange for it to receive a SIGSEGV or a SIGFPE or similar. >Fix: xlock should not exit on receipt of SIGILL, SIGEMT, SIGFPE, SIGBUS, SIGSEGV. It should of course still exit on receipt of e.g. SIGKILL. I'm not familiar enough with xlock's internals to provide a patch and be confident that it will work. Of course, if there are hardware problems or buggy code nothing will *guarantee* that xlock will carry on working... >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?E0wU93b-0001Kt-00>