SecurityFocus

GNU screen buffer overflow Nov 27 2003 01:29AM
Timo Sirainen (tss iki fi) (1 replies)

Re: GNU screen buffer overflow Dec 01 2003 11:41AM
Mariusz Woloszyn (emsi ipartners pl) (1 replies)

Re: GNU screen buffer overflow Dec 01 2003 09:48PM
Kyle Sallee (cromwell metalab unc edu) (1 replies)

Re: GNU screen buffer overflow Dec 03 2003 07:36PM
Pavel Kankovsky (peak argo troja mff cuni cz) (1 replies)

On Mon, 1 Dec 2003, Kyle Sallee wrote:

> > With devpts and libutempter it is possible to install fully functional
> > screen without suid/sgid.
>
> Does that mean any program that links with libutempter gains
> complete suid/sgid root functionality, or only when executing
> the functions in the libutempter library, please?

This means you do not need setuid root because devpts sets up the slave
pty owner and group automatically and you do not need direct access to
utmp/wtmp, e.g. via setgid utmp, because libtempter functions call an
external setgid utmp helper called utempter to modify those files (the
calling process is required to hold a corresponding master pty).

--Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."

[ reply ]

Re: GNU screen buffer overflow Dec 03 2003 09:17PM
Casper Dik (casper holland sun com)