From adrian@cougar.aceonline.com.au Sun Feb 16 23:06:45 1997 Return-Path: Received: from cougar.aceonline.com.au (adrian@cougar.aceonline.com.au [203.103.81.36]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id XAA28397 for ; Sun, 16 Feb 1997 23:06:43 -0800 (PST) Received: from localhost (adrian@localhost) by cougar.aceonline.com.au (8.8.4/8.7) with SMTP id PAA32183 for ; Mon, 17 Feb 1997 15:07:48 +0800 Date: Mon, 17 Feb 1997 15:07:47 +0800 (WST) From: Adrian Chadd To: audit-bin@freebsd.org Subject: Re : Small stuff. Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII How bout someone goes though and weeds out all the crud stuff first (eg sync *grin*, domainname, etc) ? Just so we know what we are looking at needing done. Also - an update with whats done, and what people are planning on doing might be an idea, I know /bin isn't that big but it would stop work overlapping. Just my 2c worth while I'm going though.. Cya. -- Adrian Chadd | Windows 95 - the XT emulator for | your 486 and above! | Being superstitious is bad luck. From guido@gvr.win.tue.nl Mon Feb 17 00:49:15 1997 Return-Path: Received: from gvr.win.tue.nl (root@gvr.win.tue.nl [131.155.210.19]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id AAA02360 for ; Mon, 17 Feb 1997 00:49:12 -0800 (PST) Received: (from guido@localhost) by gvr.win.tue.nl (8.8.5/8.8.2) id JAA21852; Mon, 17 Feb 1997 09:48:51 +0100 (MET) From: Guido van Rooij Message-Id: <199702170848.JAA21852@gvr.win.tue.nl> Subject: Re: Re : Small stuff. In-Reply-To: from Adrian Chadd at "Feb 17, 97 03:07:47 pm" To: adrian@cougar.aceonline.com.au (Adrian Chadd) Date: Mon, 17 Feb 1997 09:48:51 +0100 (MET) Cc: audit-bin@freebsd.org X-Mailer: ELM [version 2.4ME+ PL28 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Adrian Chadd wrote: > How bout someone goes though and weeds out all the crud stuff first > (eg sync *grin*, domainname, etc) ? Just so we know what we are looking at > needing done. > > Also - an update with whats done, and what people are planning on doing > might be an idea, I know /bin isn't that big but it would stop work > overlapping. > True. I already mailed what I did. But still I'd like everything to be looked at twice if that's not too much....Perhaps you can start with sh and csh? Currently there are 3 auditors for bin: ac,gvr,ee I suggest everyone adds his name to what he wants to audit (or what he already did). cat GVR chmod GVR cp GVR csh date GVR dd df GVR domainname GVR echo GVR ed expr GVR hostname GVR kill GVR ln GVR ls GVR mkdir GVR mv GVR pax GVR ps GVR pwd GVR rcp GVR rm GVR rmail GVR rmdir GVR sh sleep GVR stty GVR sync GVR test GVR SO basically, for me that is everything except for sh, csh, ed and dd. -Guido From top@sonic.cris.net Wed Feb 19 05:24:32 1997 Return-Path: Received: from sonic.cris.net (root@sonic.cris.net [194.93.176.69]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id FAA22183 for ; Wed, 19 Feb 1997 05:24:26 -0800 (PST) Received: (from top@localhost) by sonic.cris.net (8.7.5/8.6.12) id TAA01811 for audit-bin@freebsd.org; Wed, 19 Feb 1997 19:22:24 +0300 (MSK) From: "Alexander V. Kalganov" Message-Id: <199702191622.TAA01811@sonic.cris.net> Subject: auditing To: audit-bin@freebsd.org Date: Wed, 19 Feb 1997 19:22:24 +0300 (MSK) X-Mailer: ELM [version 2.4 PL23] MIME-Version: 1.0 Content-Type: text/plain; charset=KOI8-R Content-Transfer-Encoding: 8bit Hello. I've subscribed for /bin and would like to know if someone has already done something, so I can start working. Top. From top@sonic.cris.net Wed Feb 19 06:56:49 1997 Return-Path: Received: from sonic.cris.net (root@sonic.cris.net [194.93.176.69]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id GAA26443 for ; Wed, 19 Feb 1997 06:56:32 -0800 (PST) Received: (from top@localhost) by sonic.cris.net (8.7.5/8.6.12) id UAA03440 for audit-bin@freebsd.org; Wed, 19 Feb 1997 20:54:19 +0300 (MSK) From: "Alexander V. Kalganov" Message-Id: <199702191754.UAA03440@sonic.cris.net> Subject: hmm To: audit-bin@freebsd.org (FreeBSD audit-bin people) Date: Wed, 19 Feb 1997 20:54:19 +0300 (MSK) X-Mailer: ELM [version 2.4 PL23] MIME-Version: 1.0 Content-Type: text/plain; charset=KOI8-R Content-Transfer-Encoding: 8bit Hi Maybe this is a dumb question, but would someone explain me what the following is done for? char *p; if ((p = argv[0]) == NULL) errx(2,"test: argc is zero"); The sample was taken from the sources of test. SY, Top. From guido@gvr.win.tue.nl Wed Feb 19 11:06:13 1997 Return-Path: Received: from gvr.win.tue.nl (root@gvr.win.tue.nl [131.155.210.19]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id LAA12255 for ; Wed, 19 Feb 1997 11:06:06 -0800 (PST) Received: (from guido@localhost) by gvr.win.tue.nl (8.8.5/8.8.2) id UAA01990; Wed, 19 Feb 1997 20:05:15 +0100 (MET) From: Guido van Rooij Message-Id: <199702191905.UAA01990@gvr.win.tue.nl> Subject: Re: auditing In-Reply-To: <199702191622.TAA01811@sonic.cris.net> from "Alexander V. Kalganov" at "Feb 19, 97 07:22:24 pm" To: top@sonic.cris.net (Alexander V. Kalganov) Date: Wed, 19 Feb 1997 20:05:15 +0100 (MET) Cc: audit-bin@freebsd.org X-Mailer: ELM [version 2.4ME+ PL28 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Alexander V. Kalganov wrote: > Hello. > I've subscribed for /bin and would like to know if someone has already done > something, so I can start working. Yes. This is what I've come up with: (excerpt form an old mail by me) Okay, Here's what I've done so far: done: cat chmod cp date echo expr PATCH hostname sleep pwd df PATCH sync Below the patches. They are not security related but came up during the review ;-). The expr patch is not really necessary but was found 3 months ago when I wanted to use an expr like syntax in a program I wrote. The other one is funny: it breaks df for non-mounted file systems for root, *not* for anyone else ;-) -Guido --- expr.y.orig Mon Dec 11 23:59:22 1995 +++ expr.y Thu Feb 13 22:27:34 1997 @@ -136,6 +136,7 @@ { if (vp->type == string || vp->type == numeric_string) free (vp->u.s); + free (vp); } @@ -232,6 +233,8 @@ int argc; char **argv; { + int retval; + setlocale (LC_ALL, ""); av = argv + 1; @@ -243,7 +246,9 @@ else printf ("%s\n", result->u.s); - return (is_zero_or_null (result)); + retval = is_zero_or_null (result); + free_value(result); + return (retval); } int --- df.c.orig Thu Feb 13 22:06:14 1997 +++ df.c Thu Feb 13 21:59:40 1997 @@ -197,7 +197,7 @@ ufs_df(*argv, maxwidth); (void)rmdir(mntpt); continue; - } else if (statfs(mntpt, &statfsbuf)) { + } else if (statfs(mntpt, &statfsbuf) == 0) { statfsbuf.f_mntonname[0] = '\0'; prtstat(&statfsbuf, maxwidth); } else From guido@gvr.win.tue.nl Wed Feb 19 12:55:47 1997 Return-Path: Received: from gvr.win.tue.nl (root@gvr.win.tue.nl [131.155.210.19]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id MAA18122; Wed, 19 Feb 1997 12:54:31 -0800 (PST) Received: (from guido@localhost) by gvr.win.tue.nl (8.8.5/8.8.2) id VAA02956; Wed, 19 Feb 1997 21:53:46 +0100 (MET) From: Guido van Rooij Message-Id: <199702192053.VAA02956@gvr.win.tue.nl> Subject: Re: hmm In-Reply-To: <199702191754.UAA03440@sonic.cris.net> from "Alexander V. Kalganov" at "Feb 19, 97 08:54:19 pm" To: top@sonic.cris.net (Alexander V. Kalganov) Date: Wed, 19 Feb 1997 21:53:45 +0100 (MET) Cc: audit-bin@freebsd.org, FreeBSD-hackers@freebsd.org (FreeBSD-hackers) X-Mailer: ELM [version 2.4ME+ PL28 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Alexander V. Kalganov wrote: > Hi > Maybe this is a dumb question, but would someone explain me what the > following is done for? > > char *p; > > if ((p = argv[0]) == NULL) > errx(2,"test: argc is zero"); > It seems a bit strange to me. Just like the first part of the line underneath btw: if (*p != '\0' && p[strlen(p) - 1] == '[') { ^^^^^^^^^^ -Guido Cc: freebsd-hackers@freebsd.org From eivind@dimaga.com Wed Feb 19 13:54:19 1997 Return-Path: Received: from nic.follonett.no (nic.follonett.no [194.198.43.10]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id NAA21503 for ; Wed, 19 Feb 1997 13:54:11 -0800 (PST) Received: (from uucp@localhost) by nic.follonett.no (8.8.5/8.8.3) with UUCP id WAA03545; Wed, 19 Feb 1997 22:51:13 +0100 (MET) Received: from oo7 (oo7.dimaga.com [192.0.0.65]) by dimaga.com (8.8.5/8.7.2) with SMTP id WAA15205; Wed, 19 Feb 1997 22:04:40 +0100 (MET) Message-Id: <3.0.32.19970219220440.00bd32e0@dimaga.com> X-Sender: eivind@dimaga.com X-Mailer: Windows Eudora Pro Version 3.0 (32) Date: Wed, 19 Feb 1997 22:04:41 +0100 To: "Alexander V. Kalganov" From: Eivind Eklund Subject: Re: hmm Cc: audit-bin@freebsd.org (FreeBSD audit-bin people) Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" At 08:54 PM 2/19/97 +0300, Alexander V. Kalganov wrote: >Hi >Maybe this is a dumb question, but would someone explain me what the >following is done for? > > char *p; > > if ((p = argv[0]) == NULL) > errx(2,"test: argc is zero"); It's just a check that the program has a name - probably because the name is used in error messages later. Eivind Eklund perhaps@yes.no http://maybe.yes.no/perhaps/ eivind@freebsd.org From jmg@nike.efn.org Wed Feb 19 15:03:10 1997 Return-Path: Received: from mail.crl.com (mail.crl.com [165.113.1.22]) by freefall.freebsd.org (8.8.5/8.8.5) with SMTP id PAA24831; Wed, 19 Feb 1997 15:03:05 -0800 (PST) Received: from hydrogen.nike.efn.org (resnet.uoregon.edu) by mail.crl.com with SMTP id AA16202 (5.65c/IDA-1.5); Wed, 19 Feb 1997 14:37:21 -0800 Received: from localhost (localhost [127.0.0.1]) by hydrogen.nike.efn.org (8.8.4/8.8.4) with SMTP id OAA08110; Wed, 19 Feb 1997 14:31:04 -0800 (PST) Date: Wed, 19 Feb 1997 14:31:03 -0800 (PST) From: John-Mark Gurney Reply-To: John-Mark Gurney To: Guido van Rooij Cc: "Alexander V. Kalganov" , audit-bin@FreeBSD.ORG, FreeBSD-hackers Subject: Re: hmm In-Reply-To: <199702192053.VAA02956@gvr.win.tue.nl> Message-Id: X-Pgp-Fingerprint: B7 EC EF F8 AE ED A7 31 96 7A 22 B3 D8 56 36 F4 Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII On Wed, 19 Feb 1997, Guido van Rooij wrote: > Alexander V. Kalganov wrote: > > Hi > > Maybe this is a dumb question, but would someone explain me what the > > following is done for? > > > > char *p; > > > > if ((p = argv[0]) == NULL) > > errx(2,"test: argc is zero"); > > > > It seems a bit strange to me. Just like the first part of the line > underneath btw: > if (*p != '\0' && p[strlen(p) - 1] == '[') { > ^^^^^^^^^^ that makes sure that the strlen(p) > 0... you wouldn't want to access p[-1] would you?? hope this helps... ttyl.. John-Mark gurney_j@efn.org http://resnet.uoregon.edu/~gurney_j/ Modem/FAX: (541) 683-6954 (FreeBSD Box) Live in Peace, destroy Micro$oft, support free software, run FreeBSD (unix) From jgreco@solaria.sol.net Wed Feb 19 15:05:46 1997 Return-Path: Received: from anacreon.sol.net (anacreon.sol.net [206.55.64.116]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id PAA24951; Wed, 19 Feb 1997 15:05:44 -0800 (PST) Received: from solaria.sol.net (solaria.sol.net [206.55.65.75]) by anacreon.sol.net (8.8.5/8.6.12) with SMTP id RAA12700; Wed, 19 Feb 1997 17:05:33 -0600 (CST) Received: from localhost by solaria.sol.net (8.5/8.5) id RAA08083; Wed, 19 Feb 1997 17:05:31 -0600 From: Joe Greco Message-Id: <199702192305.RAA08083@solaria.sol.net> Subject: Re: hmm To: guido@gvr.win.tue.nl (Guido van Rooij) Date: Wed, 19 Feb 97 17:05:29 CST Cc: top@sonic.cris.net, audit-bin@freebsd.org, FreeBSD-hackers@freebsd.org In-Reply-To: <199702192053.VAA02956@gvr.win.tue.nl> from "Guido van Rooij" at Feb 19, 97 09:53:45 pm X-Mailer: ELM [version 2.4dev PL65] MIME-Version: 1.0 Content-Type: text > > char *p; > > > > if ((p = argv[0]) == NULL) > > errx(2,"test: argc is zero"); Sanity check? I can't think of any cases where this would happen, but maybe some kernel god would correct me. > It seems a bit strange to me. Just like the first part of the line > underneath btw: > if (*p != '\0' && p[strlen(p) - 1] == '[') { > ^^^^^^^^^^ That's sort of obvious, at least in the context of the second part of the expression... If you want to see if the last character in a string is '[', that is a very fast way to do it ( p[strlen(p) - 1] == '[' ). However, in the case where *p points to a zero-length string (i.e. argc[1] = ""), the expression evaluates to an invalid case: strlen(p) = 0, and 0 - 1 = -1. Taking the -1'th element of p[] is WRONG WRONG WRONG. But the ONLY time that this can happen is if you have a null string. So check for it first. It's simply a test looking for an argument that ends with the character '['. It is precisely correct, with the assumption that p is a valid, non-NULL, null terminated string of some sort. (Alternate way to think of it: If you have a zero length string, it obviously can not end in '[') ... Joe ------------------------------------------------------------------------------- Joe Greco - Systems Administrator jgreco@ns.sol.net Solaria Public Access UNIX - Milwaukee, WI 414/342-4847 From guido@gvr.win.tue.nl Wed Feb 19 23:40:07 1997 Return-Path: Received: from gvr.win.tue.nl (root@gvr.win.tue.nl [131.155.210.19]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id XAA26416; Wed, 19 Feb 1997 23:40:04 -0800 (PST) Received: (from guido@localhost) by gvr.win.tue.nl (8.8.5/8.8.2) id IAA04720; Thu, 20 Feb 1997 08:39:32 +0100 (MET) From: Guido van Rooij Message-Id: <199702200739.IAA04720@gvr.win.tue.nl> Subject: Re: hmm In-Reply-To: from John-Mark Gurney at "Feb 19, 97 02:31:03 pm" To: gurney_j@resnet.uoregon.edu Date: Thu, 20 Feb 1997 08:39:32 +0100 (MET) Cc: top@sonic.cris.net, audit-bin@FreeBSD.ORG, FreeBSD-hackers@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL28 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit > > It seems a bit strange to me. Just like the first part of the line > > underneath btw: > > if (*p != '\0' && p[strlen(p) - 1] == '[') { > > ^^^^^^^^^^ > > that makes sure that the strlen(p) > 0... you wouldn't want to access > p[-1] would you?? > > hope this helps... ttyl.. > But p points to argv[0]. According to me that is always non-empty. -Guido From jmg@nike.efn.org Wed Feb 19 23:50:40 1997 Return-Path: Received: from hydrogen.nike.efn.org (metriclient-12.uoregon.edu [128.223.172.12]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id XAA26969; Wed, 19 Feb 1997 23:50:35 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by hydrogen.nike.efn.org (8.8.4/8.8.4) with SMTP id XAA12535; Wed, 19 Feb 1997 23:50:14 -0800 (PST) Date: Wed, 19 Feb 1997 23:50:14 -0800 (PST) From: John-Mark Gurney Reply-To: John-Mark Gurney To: Guido van Rooij cc: audit-bin@FreeBSD.ORG, FreeBSD-hackers@FreeBSD.ORG Subject: Re: hmm In-Reply-To: <199702200739.IAA04720@gvr.win.tue.nl> Message-ID: X-PGP-Fingerprint: B7 EC EF F8 AE ED A7 31 96 7A 22 B3 D8 56 36 F4 MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII On Thu, 20 Feb 1997, Guido van Rooij wrote: > > > It seems a bit strange to me. Just like the first part of the line > > > underneath btw: > > > if (*p != '\0' && p[strlen(p) - 1] == '[') { > > > ^^^^^^^^^^ > > > > that makes sure that the strlen(p) > 0... you wouldn't want to access > > p[-1] would you?? > > > > hope this helps... ttyl.. > > > > But p points to argv[0]. According to me that is always non-empty. but as someone pointed out... with a direct exec it can be otherwise... I just wrote a couple programs that proved this... here's the output: number args: 3 argv[0} len(0): argv[1} len(6): parama argv[2} len(6): paramb basicly the program I ran did: char *strings[] = { "", "parama", "paramb", 0}; execv("dump", strings); and dump was a program that did basicly: for(i=0;i Received: from gvr.win.tue.nl (root@gvr.win.tue.nl [131.155.210.19]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id XAA27212; Wed, 19 Feb 1997 23:53:41 -0800 (PST) Received: (from guido@localhost) by gvr.win.tue.nl (8.8.5/8.8.2) id IAA04908; Thu, 20 Feb 1997 08:52:44 +0100 (MET) From: Guido van Rooij Message-Id: <199702200752.IAA04908@gvr.win.tue.nl> Subject: Re: hmm In-Reply-To: <199702200739.IAA04720@gvr.win.tue.nl> from Guido van Rooij at "Feb 20, 97 08:39:32 am" To: guido@gvr.win.tue.nl (Guido van Rooij) Date: Thu, 20 Feb 1997 08:52:44 +0100 (MET) Cc: gurney_j@resnet.uoregon.edu, top@sonic.cris.net, audit-bin@FreeBSD.ORG, FreeBSD-hackers@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL28 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Guido van Rooij wrote: > > > It seems a bit strange to me. Just like the first part of the line > > > underneath btw: > > > if (*p != '\0' && p[strlen(p) - 1] == '[') { > > > ^^^^^^^^^^ > > > > that makes sure that the strlen(p) > 0... you wouldn't want to access > > p[-1] would you?? > > > > hope this helps... ttyl.. > > > > But p points to argv[0]. According to me that is always non-empty. Hmm...After rereading this, I think I have it wrong :-(). That's what you get with quick answers. The check is indeed necessary. -Guido From bde@zeta.org.au Thu Feb 20 00:45:31 1997 Return-Path: Received: from godzilla.zeta.org.au (godzilla.zeta.org.au [203.2.228.19]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id AAA29363; Thu, 20 Feb 1997 00:45:30 -0800 (PST) Received: (from bde@localhost) by godzilla.zeta.org.au (8.8.3/8.6.9) id TAA27123; Thu, 20 Feb 1997 19:40:51 +1100 Date: Thu, 20 Feb 1997 19:40:51 +1100 From: Bruce Evans Message-Id: <199702200840.TAA27123@godzilla.zeta.org.au> To: guido@gvr.win.tue.nl, gurney_j@resnet.uoregon.edu Subject: Re: hmm Cc: audit-bin@freebsd.org, FreeBSD-hackers@freebsd.org, top@sonic.cris.net >But p points to argv[0]. According to me that is always non-empty. It's whatever the exec'ing process put there. Perhaps NULL or "". A NULL argv[0] isn't actually an arg. It is the NULL terminator after the args. argc == 0 in this case. Bruce From dillon@flea.best.net Thu Feb 20 15:23:44 1997 Return-Path: Received: from flea.best.net (root@flea.best.net [206.184.139.131]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id PAA14855; Thu, 20 Feb 1997 15:23:43 -0800 (PST) Received: (from dillon@localhost) by flea.best.net (8.8.5/8.8.3) id PAA19571; Thu, 20 Feb 1997 15:22:27 -0800 (PST) Date: Thu, 20 Feb 1997 15:22:27 -0800 (PST) From: Matt Dillon Message-Id: <199702202322.PAA19571@flea.best.net> To: Guido van Rooij Cc: guido@gvr.win.tue.nl (Guido van Rooij), gurney_j@resnet.uoregon.edu, top@sonic.cris.net, audit-bin@FreeBSD.ORG, FreeBSD-hackers@FreeBSD.ORG Subject: Re: hmm :Guido van Rooij wrote: :> > > It seems a bit strange to me. Just like the first part of the line :> > > underneath btw: :> > > if (*p != '\0' && p[strlen(p) - 1] == '[') { :> > > ^^^^^^^^^^ :> > :> > that makes sure that the strlen(p) > 0... you wouldn't want to access :> > p[-1] would you?? :> > :> > hope this helps... ttyl.. :> > :> :> But p points to argv[0]. According to me that is always non-empty. : :Hmm...After rereading this, I think I have it wrong :-(). That's what you get :with quick answers. The check is indeed necessary. : :-Guido The check should probably be in there, but it not being there is not likely to cause a security hole since page 0 is write-protected on FreeBSD machines. -Matt Matthew Dillon Engineering, BEST Internet Communications, Inc. [always include a portion of the original email in any response!] From guido@gvr.win.tue.nl Fri Feb 21 11:49:30 1997 Return-Path: Received: from gvr.win.tue.nl (root@gvr.win.tue.nl [131.155.210.19]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id LAA17260; Fri, 21 Feb 1997 11:49:19 -0800 (PST) Received: (from guido@localhost) by gvr.win.tue.nl (8.8.5/8.8.2) id UAA09374; Fri, 21 Feb 1997 20:47:45 +0100 (MET) From: Guido van Rooij Message-Id: <199702211947.UAA09374@gvr.win.tue.nl> Subject: Re: hmm In-Reply-To: <199702202322.PAA19571@flea.best.net> from Matt Dillon at "Feb 20, 97 03:22:27 pm" To: dillon@best.net (Matt Dillon) Date: Fri, 21 Feb 1997 20:47:45 +0100 (MET) Cc: gurney_j@resnet.uoregon.edu, top@sonic.cris.net, audit-bin@FreeBSD.ORG, FreeBSD-hackers@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL28 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit > :> > > underneath btw: > :> > > if (*p != '\0' && p[strlen(p) - 1] == '[') { > :> > > ^^^^^^^^^^ > :Hmm...After rereading this, I think I have it wrong :-(). That's what you get > :with quick answers. The check is indeed necessary. > : > :-Guido > > The check should probably be in there, but it not being there is not > likely to cause a security hole since page 0 is write-protected on FreeBSD > machines. Nono, I didn;t mean the check for p==NULL or not; I meant the check for p!="" (or equivalently: *p!='\0') -Guido From abelits@phobos.illtel.denver.co.us Sat Feb 22 02:02:09 1997 Return-Path: Received: from phobos.illtel.denver.co.us (abelits@phobos.illtel.denver.co.us [207.33.75.1]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id CAA27709; Sat, 22 Feb 1997 02:02:07 -0800 (PST) Received: from localhost (abelits@localhost) by phobos.illtel.denver.co.us (8.8.5/8.6.9) with SMTP id CAA28122; Sat, 22 Feb 1997 02:03:10 -0800 Date: Sat, 22 Feb 1997 02:03:10 -0800 (PST) From: Alex Belits To: Guido van Rooij cc: Matt Dillon , gurney_j@resnet.uoregon.edu, top@sonic.cris.net, audit-bin@freebsd.org, FreeBSD-hackers@freebsd.org Subject: Re: hmm In-Reply-To: <199702211947.UAA09374@gvr.win.tue.nl> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII On Fri, 21 Feb 1997, Guido van Rooij wrote: > > :> > > underneath btw: > > :> > > if (*p != '\0' && p[strlen(p) - 1] == '[') { > > :> > > ^^^^^^^^^^ > > :Hmm...After rereading this, I think I have it wrong :-(). That's what you get > > :with quick answers. The check is indeed necessary. > > : > > :-Guido > > > > The check should probably be in there, but it not being there is not > > likely to cause a security hole since page 0 is write-protected on FreeBSD > > machines. > > Nono, I didn;t mean the check for p==NULL or not; I meant the check > for p!="" (or equivalently: *p!='\0') with p="" *p != '\0' && p[strlen(p) - 1] == '[' _still_ will read a byte p[-1]. In most of situations not dangerous, but still potentially unaccessible memory (sorry, I have no idea where is this ugly thing from and how p is allocated). -- Alex From terry@lambert.org Sat Feb 22 10:17:56 1997 Return-Path: Received: from phaeton.artisoft.com (phaeton.Artisoft.COM [198.17.250.50]) by freefall.freebsd.org (8.8.5/8.8.5) with SMTP id KAA00364; Sat, 22 Feb 1997 10:17:55 -0800 (PST) Received: (from terry@localhost) by phaeton.artisoft.com (8.6.11/8.6.9) id LAA04865; Sat, 22 Feb 1997 11:11:57 -0700 From: Terry Lambert Message-Id: <199702221811.LAA04865@phaeton.artisoft.com> Subject: Re: hmm To: abelits@phobos.illtel.denver.co.us (Alex Belits) Date: Sat, 22 Feb 1997 11:11:56 -0700 (MST) Cc: guido@gvr.win.tue.nl, dillon@best.net, gurney_j@resnet.uoregon.edu, top@sonic.cris.net, audit-bin@FreeBSD.ORG, FreeBSD-hackers@FreeBSD.ORG In-Reply-To: from "Alex Belits" at Feb 22, 97 02:03:10 am X-Mailer: ELM [version 2.4 PL24] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit > with p="" > *p != '\0' && p[strlen(p) - 1] == '[' _still_ will read a byte p[-1]. What? IF p = "" THEN *p = '\0' by definition of ""... Terry Lambert terry@lambert.org --- Any opinions in this posting are my own and not those of my present or previous employers. From abelits@phobos.illtel.denver.co.us Sat Feb 22 12:31:27 1997 Return-Path: Received: from phobos.illtel.denver.co.us (abelits@phobos.illtel.denver.co.us [207.33.75.1]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id MAA16083; Sat, 22 Feb 1997 12:31:25 -0800 (PST) Received: from localhost (abelits@localhost) by phobos.illtel.denver.co.us (8.8.5/8.6.9) with SMTP id MAA30832; Sat, 22 Feb 1997 12:35:09 -0800 Date: Sat, 22 Feb 1997 12:35:09 -0800 (PST) From: Alex Belits To: Terry Lambert cc: guido@gvr.win.tue.nl, dillon@best.net, gurney_j@resnet.uoregon.edu, top@sonic.cris.net, audit-bin@FreeBSD.ORG, FreeBSD-hackers@FreeBSD.ORG Subject: Re: hmm In-Reply-To: <199702221811.LAA04865@phaeton.artisoft.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII On Sat, 22 Feb 1997, Terry Lambert wrote: > > with p="" > > *p != '\0' && p[strlen(p) - 1] == '[' _still_ will read a byte p[-1]. > > What? > > IF p = "" > THEN *p = '\0' > > by definition of ""... but p[strlen(p) - 1] will be p[-1] Optimization done by compiler may skip it, but depending on that will be rather dangerous. -- Alex From terry@lambert.org Sat Feb 22 13:05:37 1997 Return-Path: Received: from phaeton.artisoft.com (phaeton.Artisoft.COM [198.17.250.50]) by freefall.freebsd.org (8.8.5/8.8.5) with SMTP id NAA18547; Sat, 22 Feb 1997 13:05:37 -0800 (PST) Received: (from terry@localhost) by phaeton.artisoft.com (8.6.11/8.6.9) id OAA05142; Sat, 22 Feb 1997 14:02:06 -0700 From: Terry Lambert Message-Id: <199702222102.OAA05142@phaeton.artisoft.com> Subject: Re: hmm To: abelits@phobos.illtel.denver.co.us (Alex Belits) Date: Sat, 22 Feb 1997 14:02:06 -0700 (MST) Cc: terry@lambert.org, guido@gvr.win.tue.nl, dillon@best.net, gurney_j@resnet.uoregon.edu, top@sonic.cris.net, audit-bin@FreeBSD.ORG, FreeBSD-hackers@FreeBSD.ORG In-Reply-To: from "Alex Belits" at Feb 22, 97 12:35:09 pm X-Mailer: ELM [version 2.4 PL24] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit > > > *p != '\0' && p[strlen(p) - 1] == '[' _still_ will read a byte p[-1]. > > > > What? > > > > IF p = "" > > THEN *p = '\0' > > > > by definition of ""... > > but p[strlen(p) - 1] will be p[-1] > Optimization done by compiler may skip it, but depending on that will be > rather dangerous. && is a McCarthy AND... if the first expression is not true, then by definition of the C language use of the operator, the second expression will not be evaluated. The first expression is not true, so p[strlen(p) - 1] will never be evaluated. That's the whole point of having McCarthy operators, aside from lazy people not using !0 as boolean "true" and wanting their code to still work for fear of bitwise AND. Terry Lambert terry@lambert.org --- Any opinions in this posting are my own and not those of my present or previous employers. From abelits@phobos.illtel.denver.co.us Sat Feb 22 13:24:44 1997 Return-Path: Received: from phobos.illtel.denver.co.us (abelits@phobos.illtel.denver.co.us [207.33.75.1]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id NAA19766; Sat, 22 Feb 1997 13:24:43 -0800 (PST) Received: from localhost (abelits@localhost) by phobos.illtel.denver.co.us (8.8.5/8.6.9) with SMTP id NAA31172; Sat, 22 Feb 1997 13:28:38 -0800 Date: Sat, 22 Feb 1997 13:28:37 -0800 (PST) From: Alex Belits Reply-To: Alex Belits To: Terry Lambert cc: guido@gvr.win.tue.nl, dillon@best.net, gurney_j@resnet.uoregon.edu, top@sonic.cris.net, audit-bin@freebsd.org, FreeBSD-hackers@freebsd.org Subject: Re: hmm In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII On Sat, 22 Feb 1997, Alex Belits wrote: > On Sat, 22 Feb 1997, Terry Lambert wrote: > > > > with p="" > > > *p != '\0' && p[strlen(p) - 1] == '[' _still_ will read a byte p[-1]. > > > > What? > > > > IF p = "" > > THEN *p = '\0' > > > > by definition of ""... > > but p[strlen(p) - 1] will be p[-1] > Optimization done by compiler may skip it, but depending on that will be > rather dangerous. Hmm, sorry, I've not noticed that it's && -- Alex From eivind@dimaga.com Sat Feb 22 13:45:16 1997 Return-Path: Received: from nic.follonett.no (nic.follonett.no [194.198.43.10]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id NAA20955; Sat, 22 Feb 1997 13:45:12 -0800 (PST) Received: (from uucp@localhost) by nic.follonett.no (8.8.5/8.8.3) with UUCP id WAA26746; Sat, 22 Feb 1997 22:43:35 +0100 (MET) Received: from oo7 (oo7.dimaga.com [192.0.0.65]) by dimaga.com (8.8.5/8.7.2) with SMTP id WAA04324; Sat, 22 Feb 1997 22:45:03 +0100 (MET) Message-Id: <3.0.32.19970222224502.00ac1650@dimaga.com> X-Sender: eivind@dimaga.com X-Mailer: Windows Eudora Pro Version 3.0 (32) Date: Sat, 22 Feb 1997 22:45:03 +0100 To: Alex Belits From: Eivind Eklund Subject: Re: hmm Cc: audit-bin@FreeBSD.ORG, FreeBSD-hackers@FreeBSD.ORG Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" [Alex Belits] >>> with p="" >>> *p != '\0' && p[strlen(p) - 1] == '[' _still_ will read a byte p[-1]. [Terry Lambert] >> What? >> >> IF p = "" >> THEN *p = '\0' >> >> by definition of ""... [Alex Belits] >but p[strlen(p) - 1] will be p[-1] >Optimization done by compiler may skip it, but depending on that will be >rather dangerous. && is defined as short-circuiting. If *p == '\0' the evaluation of p[strlen(p) - 1] == '[' is guaranteed to be skipped. Re-read your book on C :) Eivind Eklund perhaps@yes.no http://maybe.yes.no/perhaps/ eivind@freebsd.org From msmith@genesis.atrad.adelaide.edu.au Sat Feb 22 15:43:59 1997 Return-Path: Received: from genesis.atrad.adelaide.edu.au (genesis.atrad.adelaide.edu.au [129.127.96.120]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id PAA00691; Sat, 22 Feb 1997 15:43:58 -0800 (PST) Received: (from msmith@localhost) by genesis.atrad.adelaide.edu.au (8.8.5/8.7.3) id KAA00728; Sun, 23 Feb 1997 10:07:43 +1030 (CST) From: Michael Smith Message-Id: <199702222337.KAA00728@genesis.atrad.adelaide.edu.au> Subject: Re: hmm In-Reply-To: from Alex Belits at "Feb 22, 97 12:35:09 pm" To: abelits@phobos.illtel.denver.co.us (Alex Belits) Date: Sun, 23 Feb 1997 10:07:42 +1030 (CST) Cc: terry@lambert.org, guido@gvr.win.tue.nl, dillon@best.net, gurney_j@resnet.uoregon.edu, top@sonic.cris.net, audit-bin@freebsd.org, FreeBSD-hackers@freebsd.org X-Mailer: ELM [version 2.4ME+ PL28 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Alex Belits stands accused of saying: > On Sat, 22 Feb 1997, Terry Lambert wrote: > > > > with p="" > > > *p != '\0' && p[strlen(p) - 1] == '[' _still_ will read a byte p[-1]. > > > > What? > > > > IF p = "" > > THEN *p = '\0' > > > > by definition of ""... > > but p[strlen(p) - 1] will be p[-1] > Optimization done by compiler may skip it, but depending on that will be > rather dangerous. We just had this discussion, and as the erring party in the previous iteration, I find myself obliged to point out that the C language specification mandates that arguments to '&&' are evaluated left-to-right, and that evaluation stops as soon as a conclusive condition is met. Thus, if *p is 0, p[-1] will _not_ be referenced. > Alex -- ]] Mike Smith, Software Engineer msmith@gsoft.com.au [[ ]] Genesis Software genesis@gsoft.com.au [[ ]] High-speed data acquisition and (GSM mobile) 0411-222-496 [[ ]] realtime instrument control. (ph) +61-8-8267-3493 [[ ]] Unix hardware collector. "Where are your PEZ?" The Tick [[ From jmb Sat Feb 22 17:04:49 1997 Return-Path: Received: (from jmb@localhost) by freefall.freebsd.org (8.8.5/8.8.5) id RAA05821; Sat, 22 Feb 1997 17:04:49 -0800 (PST) From: "Jonathan M. Bresler" Message-Id: <199702230104.RAA05821@freefall.freebsd.org> Subject: *p!='\0' (still) To: abelits@phobos.illtel.denver.co.us (Alex Belits) Date: Sat, 22 Feb 1997 17:04:48 -0800 (PST) Cc: guido@gvr.win.tue.nl, dillon@best.net, gurney_j@resnet.uoregon.edu, top@sonic.cris.net, audit-bin@FreeBSD.ORG, FreeBSD-hackers@FreeBSD.ORG In-Reply-To: from "Alex Belits" at Feb 22, 97 02:03:10 am X-Mailer: ELM [version 2.4 PL24] Content-Type: text Alex Belits wrote: > > with p="" > *p != '\0' && p[strlen(p) - 1] == '[' _still_ will read a byte p[-1]. > In most of situations not dangerous, but still potentially unaccessible > memory (sorry, I have no idea where is this ugly thing from and how p is > allocated). not true. the test *p != '\0' fails. the second half of the && statement is not executed Aspen:[14] cat /tmp/a.c #include int main(int argc, char *argv[]) { char *p = ""; if (*p != '\0') { printf("passed\n"); } else { printf("failed\n"); } } Aspen:[15] gcc -o /tmp/a.out /tmp/a.c Aspen:[16] /tmp/a.out failed Aspen:[17] uname -a FreeBSD Aspen.Woc.Atinc.COM 3.0-CURRENT FreeBSD 3.0-CURRENT #0: Sat Feb 22 19:35:37 EST 1997 jmb@Aspen.Woc.Atinc.COM:/usr/src/sys/compile/ASPEN i386 jmb From nuucp@dg-rtp.dg.com Sun Feb 23 21:50:40 1997 Return-Path: Received: from dg-rtp.dg.com (dg-rtp.rtp.dg.com [128.222.1.2]) by freefall.freebsd.org (8.8.5/8.8.5) with SMTP id VAA29716 for ; Sun, 23 Feb 1997 21:50:39 -0800 (PST) Received: by dg-rtp.dg.com (5.4R3.10/dg-rtp-v02) id AA07936; Mon, 24 Feb 1997 00:50:08 -0500 Received: from ponds by dg-rtp.dg.com.rtp.dg.com; Mon, 24 Feb 1997 00:50 EST Received: from lakes.water.net (lakes [10.0.0.3]) by ponds.water.net (8.8.3/8.7.3) with ESMTP id TAA08441; Sun, 23 Feb 1997 19:56:49 -0500 (EST) Received: (from rivers@localhost) by lakes.water.net (8.8.3/8.6.9) id UAA11182; Sun, 23 Feb 1997 20:01:57 -0500 (EST) Date: Sun, 23 Feb 1997 20:01:57 -0500 (EST) From: Thomas David Rivers Message-Id: <199702240101.UAA11182@lakes.water.net> To: ponds!lakes.water.net!phobos.illtel.denver.co.us, ponds!lambert.org!terry Subject: Re: hmm Cc: ponds!freebsd.org!audit-bin, ponds!best.net!dillon, ponds!freebsd.org!FreeBSD-hackers, ponds!gvr.win.tue.nl!guido, ponds!resnet.uoregon.edu!gurney_j, ponds!sonic.cris.net!top Content-Type: text > > On Sat, 22 Feb 1997, Terry Lambert wrote: > > > > with p="" > > > *p != '\0' && p[strlen(p) - 1] == '[' _still_ will read a byte p[-1]. > > > > What? > > > > IF p = "" > > THEN *p = '\0' > > > > by definition of ""... > > but p[strlen(p) - 1] will be p[-1] > Optimization done by compiler may skip it, but depending on that will be > rather dangerous. > > -- > Alex > > It may not be too clear... but, and at the risk of repeating what other's may have indicated - the C language, by definition, evaluates this from left to right. And, in the situation above (a logical-and) the first 0-valued expression will cause the result of the logical-and to be 0. Furthermore, the a compiler, or optimizer, is forbidden from evaluating the rest of the expression. That is, if *p is equal to '\0' - the remainder of the logical-and will not be evaluated... if an optimizer does cause this to happen, the compiler/optimizer is in error. So, if strlen(p) was 0, it wouldn't matter; p[-1] would never be referenced. In this veign you'll also often see code like: if(p != NULL && !strcmp(p,"some value") ) the left side of logical-and guarantees that the pointer 'p' is not NULL. The right side of the logical-and can then safely dereference 'p'. Again; this isn't a coincedence, C is defined (from the early K&R days) to behave in this manner. In compiler terms it's called short-circuit evaluation of logical expressions... - Dave Rivers - From imp@village.org Mon Feb 24 17:53:38 1997 Return-Path: Received: from rover.village.org (rover.village.org [204.144.255.49]) by freefall.freebsd.org (8.8.5/8.8.5) with SMTP id RAA09372 for ; Mon, 24 Feb 1997 17:53:36 -0800 (PST) Received: from rover.village.org [127.0.0.1] by rover.village.org with esmtp (Exim 0.56 #1) id E0vzC5G-0005Tm-00; Mon, 24 Feb 1997 18:53:34 -0700 To: audit-bin@freebsd.org Subject: Patches Date: Mon, 24 Feb 1997 18:53:34 -0700 From: Warner Losh Message-Id: -----BEGIN PGP SIGNED MESSAGE----- Please find enclosed patches for mv. This fixes two PRs that I don't recall the numbers of. These fixes are from OpenBSD. I want to commit them as soon as possible because it leaves around setuid files that owners may not have indended to be setuid. Warner Index: mv.c =================================================================== RCS file: /home/imp/FreeBSD/CVS/src/bin/mv/mv.c,v retrieving revision 1.10 diff -u -r1.10 mv.c - --- mv.c 1997/01/14 05:31:31 1.10 +++ mv.c 1997/02/18 01:09:40 @@ -207,17 +207,24 @@ static u_int blen; static char *bp; register int nread, from_fd, to_fd; + int badchown = 0, serrno; if ((from_fd = open(from, O_RDONLY, 0)) < 0) { warn("%s", from); return (1); } - - if ((to_fd = - - open(to, O_CREAT | O_TRUNC | O_WRONLY, sbp->st_mode)) < 0) { + if ((to_fd = open(to, O_CREAT | O_TRUNC | O_WRONLY, 0600)) < 0) { warn("%s", to); (void)close(from_fd); return (1); } + + if (fchown(to_fd, sbp->st_uid, sbp->st_gid)) { + serrno = errno; + badchown = 1; + } + (void) fchmod(to_fd, sbp->st_mode & ~(S_ISUID|S_ISGID)); + if (!blen && !(bp = malloc(blen = sbp->st_blksize))) { warn(NULL); return (1); @@ -237,8 +244,15 @@ } (void)close(from_fd); - - if (fchown(to_fd, sbp->st_uid, sbp->st_gid)) - - warn("%s: set owner/group", to); + if (badchown) { + errno = serrno; + if ((sbp->st_mode & (S_ISUID|S_ISGID))) { + warn("%s: set owner/group; not setting setuid/setgid", + to); + sbp->st_mode &= ~(S_ISUID|S_ISGID); + } else if (!fflg) + warn("%s: set owner/group", to); + } if (fchmod(to_fd, sbp->st_mode)) warn("%s: set mode", to); -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBMxJGDdxynu/2qPVhAQErtgP/Y8xivLxmYOCvDBEtbALukWt5YS+wyUwm fuzR97sb2r724Zm9Jos4bM+Ywwp8cwK/Q52cz8ghP5FOKeqIp89Dd8Dh36PxwNQd AmTNz8llsr/Z1qqYu4XRQniFAJ2t+GYcCw3rdpXr7OuSrGHpt4lVjX8MsyvBvQo9 xl49jX5Xhjc= =MsaI -----END PGP SIGNATURE----- From mazal@netvision.net.il Tue Sep 1 13:38:03 1998 Return-Path: Received: from P1 ([192.117.232.9]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id NAA19300 for ; Tue, 1 Sep 1998 13:37:49 -0700 (PDT) (envelope-from mazal@netvision.net.il) From: mazal@netvision.net.il Received: from default - 192.117.233.58 by isdn.net.il with Microsoft SMTPSVC; Tue, 1 Sep 1998 23:22:29 +0300 Date: Tue, 01 Sep 1998 23:25:01 +0300 Sender: mazal@netvision.net.il Subject: US$ 120.000.000 de Dolares To: audit-bin@freebsd.org X-Mailer: Message-ID: <0aa5f2922200198P1@isdn.net.il> Estimado navegante: US$ 120.000.000 lo esperan en: http://209.75.79.87/mazal y un tentador regalo para el espiritu en: http://209.75.79.87/tierra Nunca su bolsillo y su espiritu estuvieron tan cerca de enriquecerse. Gracias por su atencion.- R.M. Srul Mazal Israel Ltd mazal7@aquanet.co.il From print2live@angelfire.com Sat Mar 20 19:03:30 1999 Delivered-To: audit-bin@freebsd.org Received: from server2525 (ip157.moorestown4.nj.pub-ip.psi.net [38.26.85.157]) by hub.freebsd.org (Postfix) with SMTP id 045CC15176 for ; Sat, 20 Mar 1999 19:03:23 -0800 (PST) (envelope-from print2live@angelfire.com) To: From: Subject: AD:Family Reunion T Shirts & More Date: Sat, 20 Mar 1999 18:28:12 Return-Path: Message-Id: <19990321030324.045CC15176@hub.freebsd.org> Message sent by: Kuppler Graphics, 32 West Main Street, Maple Shade, New Jersey, 08052, 1-800-810-4330. This list will NOT be sold. All addresses are automatically added to our remove list. Hello. My name is Bill from Kuppler Graphics. We do screenprinting on T Shirts, Sweatshirts, Jackets, Hats, Tote Bags and more! Do you or someone you know have a Family Reunion coming up? Kuppler Graphics would like to provide you with some great looking T Shirts for your Reunion. Kuppler Graphics can also provide you with custom T's and promotional items such as imprinted magnets, keychains, pens, mugs, hats, etc. for your business or any fundraising activity (church, school, business etc.) We also can provide you with quality embroidery. We are a family owned company with over 15 years of experience. All work is done at this location. No middle man. Our prices are great! Click reply to email us or call 1-800-810-4330 for more info Bill Kuppler Graphics From remailer@replay.com Sun Mar 28 16:58:31 1999 Return-Path: Delivered-To: audit-bin@freebsd.org Received: from unknown (1Cust90.tnt3.atl2.da.uu.net [153.36.17.90]) by hub.freebsd.org (Postfix) with SMTP id 1CD3F1546D; Sun, 28 Mar 1999 16:58:21 -0800 (PST) (envelope-from remailer@replay.com) From: Subject: toner sales advertising Date: Mon, 29 Mar 1999 04:33:14 Message-Id: <19990329005825.1CD3F1546D@hub.freebsd.org> BENCHMARK PRINT SUPPLY LASER PRINTER CARTRIDGES JUST FOR YOU AS WELL AS FAX AND COPIER TONER CHECK OUT THESE NEW PRINT CARTRIDGE PRICES : APPLE LASER WRITER PRO 600 OR 16/600 $69 LASER WRITER SELECT 300,310.360 $64 LASER WRITER 300, 320, 360 $54 LASER WRITER LS,NT,2NTX,2F,2G & 2SC $54 LASER WRITER 12/640 $79 HEWLETT PACKARD LASERJET SERIES 2,3 & 3D $49 LASERJET SERIES 2P AND 3P $54 LASERJET SERIES 3SI AND 4SI $75 LASERJET SERIES 4L AND 4P $49 LASERJET SERIES 4, 4M, 5, 5M $59 LASERJET SERIES 4000 HIGH YIELD $99 LASERJET SERIES 4V $95 LASERJET SERIES 5SI , 8000 $95 LASERJET SERIES 5L AND 6L $49 LASERJET SERIES 5P, 5MP, 6P, 6MP $59 LASERJET SERIES 5000 $89 HP LASERFAX LASERFAX 500, 700, FX1, $59 LASERFAX 5000, 7000, FX2, $59 LASERFAX FX3 $69 LASERFAX FX4 $79 LEXMARK OPTRA 4019, 4029 HIGH YIELD $135 OPTRA R, 4039, 4049 HIGH YIELD $135 OPTRA S 4059 HIGH YIELD $135 OPTRA E $59 OPTRA N $115 EPSON EPL-70000, 8000 $105 EPL-1000, 1500 $105 CANON LBP-430 $49 LBP-460, 465 $59 LBP-8 II $54 LBP-LX $54 LBP-MX $95 LBP-AX $49 LBP-EX $59 LBP-SX $49 LBP-BX $95 LBP-PX $49 LBP-WX $95 LBP-VX $59 CANON FAX L700 THRU L790 FX1 $59 CANONFAX L5000 L70000 FX2 $59 CANON COPIERS PC 20, 25 ETC.... $89 PC 3, 6RE, 7, 11 (A30) $69 PC 320 THRU 700 (E40) $89 NEC SERIES 2 LASER MODEL 95 $105 PLACE YOUR ORDER BY : PHONE 770-399-0953 FAX: 770-698-9700 E-MAIL: BENCHMARK1@USA.NET WITH SUBJECTLINE: ORDER MAIL: 1091 REDSTONE LANE, ATLANTA GA 30338 MAKE SURE YOU INCLUDE THE FOLLOWING INFORMATION IN YOUR ORDER: 1) PHONE NUMBER 2) COMPANY NAME 3) SHIPPING ADDRESS 4) YOUR NAME 5) ITEMS NEEDED WITH QUANTITIES 6) METHOD OF PAYMENT. (COD OR CREDIT CARD) 7) CREDIT CARD NUMBER WITH EXPIRATION DATE WE SHIP UPS GROUND STANDARD. ADD $4.5 FOR SHIPPING AND HANDLING. FOR ORDER QUESTIONS CALL 770-399-0953 FOR CUSTOMER SERVICE 770-399-5505 FOR E-MAIL REMOVAL USE: BENCHMARK2@USA.NET OR CALL 770-399-5614 From workshop@npcollege-edu.net Sun Jul 4 16:01:48 1999 Return-Path: Delivered-To: audit-bin@freebsd.org Received: from npcollege-edu.net (mail.npcollege-edu.net [209.232.226.194]) by hub.freebsd.org (Postfix) with SMTP id 65BB3151A1; Sun, 4 Jul 1999 16:01:39 -0700 (PDT) (envelope-from workshop@npcollege-edu.net) From: Subject: Re: Deleting Your Address. Date: Sun, 4 Jul 1999 12:36:42 Message-Id: <809.836511.379708@npcollege-edu.net> From:The SFSE(Scientific Facts Search Engine). When you send an email to EDU,R&D,or Job sites,your email might be forwarded via the SFSE to find the info you are looking for. The NU(NewAmerica University)has received a copy of your email,but the date is Feb/25/99.Do you still need this info? To refresh your memory you can go again to the NU website and look for these topics: "The Redeemat has solved all environmental problems"-"The 9% Producer Fee would eliminate crime & taxes within 3 years"-"The free NHRI (National Health & Retirement Insurance")- "The job guarantee system(JIC/Job Insurance Corporation)"and "The list of 22nd Centurys' products & businesses available right now". Or,request for the records of the SFSE search by putting in the subject REQUESTING INFO and click REPLY. Or,in the future send "REQUEST FOR SEARCH" (on any topic) directly to SFSE, and they will do the search for you,put in the subject SFSE. Or,please allow us to DELETE your address permanently by simply clicking REPLY. B.Morrison workshop@npcollege-edu.net From pplegal@hotmail.com Thu Aug 19 01:07:27 1999 Return-Path: Delivered-To: audit-bin@freebsd.org Received: from mx1.magmacom.com (mx1.magmacom.com [206.191.0.217]) by hub.freebsd.org (Postfix) with ESMTP id 2DDAF150A5; Thu, 19 Aug 1999 01:07:20 -0700 (PDT) (envelope-from pplegal@hotmail.com) Received: from mail3.magma.ca (mail3.magma.ca [206.191.0.221]) by mx1.magmacom.com (8.9.1a/8.9.1) with ESMTP id EAA10083; Thu, 19 Aug 1999 04:02:31 -0400 (EDT) From: pplegal@hotmail.com Received: from cyberblitz.com (harris.magma.ca [209.217.80.7]) by mail3.magma.ca (8.9.3/8.9.3) with ESMTP id EAA22053; Thu, 19 Aug 1999 04:02:28 -0400 (EDT) Received: from 212.19.195.12 (01-024.033.popsite.net [216.3.182.24]) by cyberblitz.com (8.9.1/8.9.1) with SMTP id EAA08195; Thu, 19 Aug 1999 04:02:15 -0400 (EDT) Message-ID: <00006db11c78$000067f6$00005c7f@212.19.195.12> To: Subject: WOW! FANTASTIC NEW BUSINESS FOR YOUR AREA! Date: Thu, 19 Aug 1999 03:51:52 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal

The Hottest Bus= iness Opportunity to Hit
the U.S. this Year!

This is not a MLM = Program !
Earn Full Time Inc= ome on a Part Time Basis !!!

New Photo Postcard vending machines which put you= r face on a postcard
are a smashing success throughout Europe.

Now for the first time these machines are ava= ilable in the U.S.
The U.S. market will grow to thousands of machines within the next
12-18 months according to industry experts. We are seeking qualified indiv= iduals
who are looking to take advantage of a virtually untapped market opportuni= ty in
their area. There are retail locations across the country ......waiting ! =

Timing is Everything !

We have developed the new self-service Personal P= ost Card to take advantage
of this dynamic market opportunity. Personal Post Cards combines the popul= arity
of the following markets:

Travel and Leisure Ma= rket $200 billion
Greeting Card $10 bil= lion
Photography $30 billio= n

The Opportunity Is:

Part or full time
No selling required No prior experience or= office required
All cash business!
Financing programs ava= ilable

For a Free Business Package at N= o Obligation:

1-888-852-7900
Please refer to Code F818 when you call.

Customer Service Opera= tors are available
Monday-Friday 9:00am - 9:00pm EST Saturday-Sunday 12:00 pm to 8 pm EST.

If you are outside the U.S. please fax your name, complete phone number including country code and a good time for us to call you to (954)236-7264= .
We will respond to your request as soon as possible.

This offer is not vali= d in all statesand should not be considered an offer
in states where the company is not registered.

If you no longer desir= e to receive email from us, please email us,
CLICK HERE.

The Hottest Bu= siness Opportunity to Hit

the U.S. this Year!

From searches@freeola.com Fri Oct 15 12:37:02 1999 Return-Path: Delivered-To: audit-bin@freebsd.org Received: from mailhub5.libertysurf.fr (mailhub5.libertysurf.fr [195.154.209.25]) by hub.freebsd.org (Postfix) with ESMTP id CF8B714D7F; Fri, 15 Oct 1999 12:36:52 -0700 (PDT) (envelope-from searches@freeola.com) Received: from mail.libertysurf.fr (ppp170-toulon.libertysurf.fr [213.36.56.170]) by mailhub5.libertysurf.fr (8.9.3/8.9.3) with SMTP id VAA20451; Fri, 15 Oct 1999 21:33:37 +0200 (CEST) From: searches@freeola.com Message-Id: <199910151933.VAA20451@mailhub5.libertysurf.fr> To: Friend@public.com Date: Fri, 15 Oct 99 20:52:42 EST Subject: Your Web Page Increase your Web Site visiblity ! Try out : *** Proven Web Page Optimisation Software *** >> Audited results 55% Number 1 90% top 5 << *** Macro Media Web Page Design Software **** >>> Make your Web Pages sparkle <<<< **** Accept checks from your Web Site ***** >>>> Improve your margins & Cashflow <<<< Go to : http://www.freebizlinks.net