From aaronb@j51.com Sat Feb 15 19:07:15 1997 Return-Path: Received: from j51.com (root@gorplex.j51.com [199.224.7.51]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id TAA08228 for ; Sat, 15 Feb 1997 19:07:14 -0800 (PST) Received: (from aaronb@localhost) by j51.com (8.8.5/8.8.5) id WAA11885; Sat, 15 Feb 1997 22:07:29 -0500 (EST) Date: Sat, 15 Feb 1997 22:07:28 -0500 (EST) From: Aaron Bornstein To: audit-lib@freebsd.org Subject: tgetent Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Hey, I know I'm not on the lib team, but I found and patched a bug in libtermcap, so I thought I should let you guys know :) There's a buffer overflow in tgetent under certain circumstances, circumstances which are easy for a cracker to influence. Here's the patch, it's untested, so I won't guarantee anything: --- libtermcap/termcap.c.old Sat Feb 15 20:01:15 1997 +++ libtermcap/termcap.c Sat Feb 15 20:00:45 1997 @@ -35,19 +35,20 @@ static char sccsid[] = "@(#)termcap.c 8.1 (Berkeley) 6/4/93"; #endif /* not lint */ -#define PBUFSIZ 512 /* max length of filename path */ -#define PVECSIZ 32 /* max number of names in path */ -#define TBUFSIZ 1024 /* max length of tgetent buffer */ - #include #include #include #include #include #include +#include /* MAXPATHLEN */ #include "termcap.h" #include "pathnames.h" +#define PBUFSIZ MAXPATHLEN /* max length of filename path */ +#define PVECSIZ 32 /* max number of names in path */ +#define TBUFSIZ 1024 /* max length of tgetent buffer */ + extern void __set_ospeed(speed_t speed); /* @@ -101,19 +102,23 @@ * becomes "$HOME/.termcap /etc/termcap" if no TERMPATH exists. */ if (!cp || *cp != '/') { /* no TERMCAP or it holds an entry */ - if (termpath = getenv("TERMPATH")) + if (termpath = getenv("TERMPATH")) { strncpy(pathbuf, termpath, PBUFSIZ); - else { - if (home = getenv("HOME")) { /* set up default */ - p += strlen(home); /* path, looking in */ - strcpy(pathbuf, home); /* $HOME first */ - *p++ = '/'; + pathbuf[PBUFSIZ-1] = '\0'; + } else { + /* set up default path */ + if (home = getenv("HOME")) { + sprintf(pathbuf, "%.*s/", PBUFSIZ-2, home); + p += strlen(pathbuf); } /* if no $HOME look in current directory */ strncpy(p, _PATH_DEF, PBUFSIZ - (p - pathbuf)); + pathbuf[PBUFSIZ-1] = '\0'; } } - else /* user-defined name in TERMCAP */ + else { /* user-defined name in TERMCAP */ strncpy(pathbuf, cp, PBUFSIZ); /* still can be tokenized */ + pathbuf[PBUFSIZ-1] = '\0'; + } *fname++ = pathbuf; /* tokenize path into vector of names */ while (*++p) --Aaron From apk@itl.waw.pl Sat Feb 15 19:55:34 1997 Return-Path: Received: from mail.itl.waw.pl (root@mail.itl.waw.pl [193.59.6.1]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id TAA10518 for ; Sat, 15 Feb 1997 19:55:31 -0800 (PST) Received: from saturn.itl.waw.pl (saturn.itl.waw.pl [193.59.6.4]) by mail.itl.waw.pl (8.7.6/8.7.3) with ESMTP id EAA15970; Sun, 16 Feb 1997 04:48:44 +0100 (MET) Received: (from apk@localhost) by saturn.itl.waw.pl (8.8.4/8.8.4) id FAA13037; Sun, 16 Feb 1997 05:52:44 +0100 (CET) From: Adam Kubicki Message-Id: <199702160452.FAA13037@saturn.itl.waw.pl> Subject: Re: tgetent In-Reply-To: from Aaron Bornstein at "Feb 15, 97 10:07:28 pm" To: aaronb@j51.com (Aaron Bornstein) Date: Sun, 16 Feb 1997 05:52:44 +0100 (CET) Cc: audit-lib@freebsd.org X-Mailer: ELM [version 2.4ME+ PL28 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit hi, > > Hey, I know I'm not on the lib team, but I found and patched a > bug in libtermcap, so I thought I should let you guys know :) > There's a buffer overflow in tgetent under certain circumstances, > circumstances which are easy for a cracker to influence. sorry, but it looks bad. nevermind still possible exploit (at first look) you surely can cause to get sigsegv then core dump. Few weeks ago i've sent to Joerg similar bug in stdtime which allows to overwrite any file on sytem (via symlink to core) or geting master.passwd file. Some programs which runs as root (like login running from telnetd instdtime example) with euid=uid could be fooled this way. There will be some problems with this i think, those stdtime scenarios (when data reead from file is used as various offsets) are hard to fix. -adam From imp@village.org Mon Feb 17 23:05:51 1997 Return-Path: Received: from rover.village.org (rover.village.org [204.144.255.49]) by freefall.freebsd.org (8.8.5/8.8.5) with SMTP id XAA02200 for ; Mon, 17 Feb 1997 23:05:49 -0800 (PST) Received: from rover.village.org [127.0.0.1] by rover.village.org with esmtp (Exim 0.56 #1) id E0vwjcZ-0002Hl-00; Tue, 18 Feb 1997 00:05:47 -0700 To: audit-lib@freebsd.org Subject: Please review (and ack) this change to libtermcap. Date: Tue, 18 Feb 1997 00:05:46 -0700 From: Warner Losh Message-Id: -----BEGIN PGP SIGNED MESSAGE----- Here's a minor patch to libtermcap that is a buffer overflow from HOME that might be exploitable by setuid curses/libtermcap programs. Don't know any that do that, so I don't think this is a huge deal. Thanks to Theo de Raadt for asking me a simple question that made me look at this. Since I'm pgp signing this, saying "sed -e 's/^- //'" now may save some mail to me :-). Please let me know that someone is taking care of this, or I'll go ahead and commit it. I don't want it falling through the cracks. Warner Index: termcap.c =================================================================== RCS file: /home/imp/FreeBSD/CVS/src/lib/libtermcap/termcap.c,v retrieving revision 1.7 diff -u -r1.7 termcap.c - --- termcap.c 1996/07/12 18:57:25 1.7 +++ termcap.c 1997/02/18 06:58:32 @@ -105,8 +105,9 @@ strncpy(pathbuf, termpath, PBUFSIZ); else { if ( (home = getenv("HOME")) ) {/* set up default */ - - p += strlen(home); /* path, looking in */ - - strcpy(pathbuf, home); /* $HOME first */ + strncpy(pathbuf, home, PBUFSIZ); /* $HOME first */ + pathbuf[PBUFSIZ - 1] = '\0'; + p += strlen(pathbuf); /* path, looking in */ *p++ = '/'; } /* if no $HOME look in current directory */ strncpy(p, _PATH_DEF, PBUFSIZ - (p - pathbuf)); @@ -114,6 +115,7 @@ } else /* user-defined name in TERMCAP */ strncpy(pathbuf, cp, PBUFSIZ); /* still can be tokenized */ + pathbuf[PBUFSIZ - 1] = '\0'; *fname++ = pathbuf; /* tokenize path into vector of names */ while (*++p) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBMwlUcNxynu/2qPVhAQG+awP/XTg1jrAAWAKG9S+9NZALrM578zmP1z86 2iEdFO8MsBK2gDomhdDbj0fvNh/8JwITOUlLuS7X9bOGilnVEK7yIjsoOMQ3fSzT mwFR3QQdv9pBUhwk52J2rgEyLLNAPxhU57at7yOcQ2QNG0L/EJVlMYp8QsYKHkxV SYqyy2fhzKo= =bPXa -----END PGP SIGNATURE----- From guido@gvr.win.tue.nl Tue Feb 18 01:05:17 1997 Return-Path: Received: from gvr.win.tue.nl (root@gvr.win.tue.nl [131.155.210.19]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id BAA15650 for ; Tue, 18 Feb 1997 01:05:15 -0800 (PST) Received: (from guido@localhost) by gvr.win.tue.nl (8.8.5/8.8.2) id KAA27124; Tue, 18 Feb 1997 10:04:25 +0100 (MET) From: Guido van Rooij Message-Id: <199702180904.KAA27124@gvr.win.tue.nl> Subject: Re: Please review (and ack) this change to libtermcap. In-Reply-To: from Warner Losh at "Feb 18, 97 00:05:46 am" To: imp@village.org (Warner Losh) Date: Tue, 18 Feb 1997 10:04:25 +0100 (MET) Cc: audit-lib@freebsd.org X-Mailer: ELM [version 2.4ME+ PL28 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit > Here's a minor patch to libtermcap that is a buffer overflow from HOME > that might be exploitable by setuid curses/libtermcap programs. Don't > know any that do that, so I don't think this is a huge deal. > Seems okay to me. -Guido From mazal@netvision.net.il Tue Sep 1 13:38:31 1998 Return-Path: Received: from P1 ([192.117.232.9]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id NAA19495 for ; Tue, 1 Sep 1998 13:38:25 -0700 (PDT) (envelope-from mazal@netvision.net.il) From: mazal@netvision.net.il Received: from default - 192.117.233.58 by isdn.net.il with Microsoft SMTPSVC; Tue, 1 Sep 1998 23:22:40 +0300 Date: Tue, 01 Sep 1998 23:25:11 +0300 Sender: mazal@netvision.net.il Subject: US$ 120.000.000 de Dolares To: audit-lib@freebsd.org X-Mailer: Message-ID: <0a6bf4022200198P1@isdn.net.il> Estimado navegante: US$ 120.000.000 lo esperan en: http://209.75.79.87/mazal y un tentador regalo para el espiritu en: http://209.75.79.87/tierra Nunca su bolsillo y su espiritu estuvieron tan cerca de enriquecerse. Gracias por su atencion.- R.M. Srul Mazal Israel Ltd mazal7@aquanet.co.il From print2live@angelfire.com Sat Mar 20 19:03:32 1999 Delivered-To: audit-lib@freebsd.org Received: from server2525 (ip157.moorestown4.nj.pub-ip.psi.net [38.26.85.157]) by hub.freebsd.org (Postfix) with SMTP id 2B9D015182 for ; Sat, 20 Mar 1999 19:03:23 -0800 (PST) (envelope-from print2live@angelfire.com) To: From: Subject: AD:Family Reunion T Shirts & More Date: Sat, 20 Mar 1999 18:28:15 Return-Path: Message-Id: <19990321030324.2B9D015182@hub.freebsd.org> Message sent by: Kuppler Graphics, 32 West Main Street, Maple Shade, New Jersey, 08052, 1-800-810-4330. This list will NOT be sold. All addresses are automatically added to our remove list. Hello. My name is Bill from Kuppler Graphics. We do screenprinting on T Shirts, Sweatshirts, Jackets, Hats, Tote Bags and more! Do you or someone you know have a Family Reunion coming up? Kuppler Graphics would like to provide you with some great looking T Shirts for your Reunion. Kuppler Graphics can also provide you with custom T's and promotional items such as imprinted magnets, keychains, pens, mugs, hats, etc. for your business or any fundraising activity (church, school, business etc.) We also can provide you with quality embroidery. We are a family owned company with over 15 years of experience. All work is done at this location. No middle man. Our prices are great! Click reply to email us or call 1-800-810-4330 for more info Bill Kuppler Graphics From remailer@replay.com Sun Mar 28 16:58:31 1999 Return-Path: Delivered-To: audit-lib@freebsd.org Received: from unknown (1Cust90.tnt3.atl2.da.uu.net [153.36.17.90]) by hub.freebsd.org (Postfix) with SMTP id 1CD3F1546D; Sun, 28 Mar 1999 16:58:21 -0800 (PST) (envelope-from remailer@replay.com) From: Subject: toner sales advertising Date: Mon, 29 Mar 1999 04:33:14 Message-Id: <19990329005825.1CD3F1546D@hub.freebsd.org> BENCHMARK PRINT SUPPLY LASER PRINTER CARTRIDGES JUST FOR YOU AS WELL AS FAX AND COPIER TONER CHECK OUT THESE NEW PRINT CARTRIDGE PRICES : APPLE LASER WRITER PRO 600 OR 16/600 $69 LASER WRITER SELECT 300,310.360 $64 LASER WRITER 300, 320, 360 $54 LASER WRITER LS,NT,2NTX,2F,2G & 2SC $54 LASER WRITER 12/640 $79 HEWLETT PACKARD LASERJET SERIES 2,3 & 3D $49 LASERJET SERIES 2P AND 3P $54 LASERJET SERIES 3SI AND 4SI $75 LASERJET SERIES 4L AND 4P $49 LASERJET SERIES 4, 4M, 5, 5M $59 LASERJET SERIES 4000 HIGH YIELD $99 LASERJET SERIES 4V $95 LASERJET SERIES 5SI , 8000 $95 LASERJET SERIES 5L AND 6L $49 LASERJET SERIES 5P, 5MP, 6P, 6MP $59 LASERJET SERIES 5000 $89 HP LASERFAX LASERFAX 500, 700, FX1, $59 LASERFAX 5000, 7000, FX2, $59 LASERFAX FX3 $69 LASERFAX FX4 $79 LEXMARK OPTRA 4019, 4029 HIGH YIELD $135 OPTRA R, 4039, 4049 HIGH YIELD $135 OPTRA S 4059 HIGH YIELD $135 OPTRA E $59 OPTRA N $115 EPSON EPL-70000, 8000 $105 EPL-1000, 1500 $105 CANON LBP-430 $49 LBP-460, 465 $59 LBP-8 II $54 LBP-LX $54 LBP-MX $95 LBP-AX $49 LBP-EX $59 LBP-SX $49 LBP-BX $95 LBP-PX $49 LBP-WX $95 LBP-VX $59 CANON FAX L700 THRU L790 FX1 $59 CANONFAX L5000 L70000 FX2 $59 CANON COPIERS PC 20, 25 ETC.... $89 PC 3, 6RE, 7, 11 (A30) $69 PC 320 THRU 700 (E40) $89 NEC SERIES 2 LASER MODEL 95 $105 PLACE YOUR ORDER BY : PHONE 770-399-0953 FAX: 770-698-9700 E-MAIL: BENCHMARK1@USA.NET WITH SUBJECTLINE: ORDER MAIL: 1091 REDSTONE LANE, ATLANTA GA 30338 MAKE SURE YOU INCLUDE THE FOLLOWING INFORMATION IN YOUR ORDER: 1) PHONE NUMBER 2) COMPANY NAME 3) SHIPPING ADDRESS 4) YOUR NAME 5) ITEMS NEEDED WITH QUANTITIES 6) METHOD OF PAYMENT. (COD OR CREDIT CARD) 7) CREDIT CARD NUMBER WITH EXPIRATION DATE WE SHIP UPS GROUND STANDARD. ADD $4.5 FOR SHIPPING AND HANDLING. FOR ORDER QUESTIONS CALL 770-399-0953 FOR CUSTOMER SERVICE 770-399-5505 FOR E-MAIL REMOVAL USE: BENCHMARK2@USA.NET OR CALL 770-399-5614 From workshop@npcollege-edu.net Sun Jul 4 16:01:37 1999 Return-Path: Delivered-To: audit-lib@freebsd.org Received: from npcollege-edu.net (mail.npcollege-edu.net [209.232.226.194]) by hub.freebsd.org (Postfix) with SMTP id 57EE415167; Sun, 4 Jul 1999 16:01:33 -0700 (PDT) (envelope-from workshop@npcollege-edu.net) From: Subject: Re: Deleting Your Address. Date: Sun, 4 Jul 1999 12:36:31 Message-Id: <376.712647.27749@npcollege-edu.net> From:The SFSE(Scientific Facts Search Engine). When you send an email to EDU,R&D,or Job sites,your email might be forwarded via the SFSE to find the info you are looking for. The NU(NewAmerica University)has received a copy of your email,but the date is Feb/25/99.Do you still need this info? To refresh your memory you can go again to the NU website and look for these topics: "The Redeemat has solved all environmental problems"-"The 9% Producer Fee would eliminate crime & taxes within 3 years"-"The free NHRI (National Health & Retirement Insurance")- "The job guarantee system(JIC/Job Insurance Corporation)"and "The list of 22nd Centurys' products & businesses available right now". Or,request for the records of the SFSE search by putting in the subject REQUESTING INFO and click REPLY. Or,in the future send "REQUEST FOR SEARCH" (on any topic) directly to SFSE, and they will do the search for you,put in the subject SFSE. Or,please allow us to DELETE your address permanently by simply clicking REPLY. B.Morrison workshop@npcollege-edu.net From pplegal@hotmail.com Wed Aug 18 21:43:24 1999 Return-Path: Delivered-To: audit-lib@freebsd.org Received: from freewebstore.net (farley.adgrafix.com [208.230.130.233]) by hub.freebsd.org (Postfix) with ESMTP id 1271A1503C; Wed, 18 Aug 1999 21:43:06 -0700 (PDT) (envelope-from pplegal@hotmail.com) Received: from 160.92.127.3 (01-020.033.popsite.net [216.3.182.20]) by freewebstore.net (8.9.0/8.9.0) with SMTP id AAA03763; Thu, 19 Aug 1999 00:43:21 -0400 (EDT) From: pplegal@hotmail.com Message-ID: <000079522561$00007194$00004600@160.92.127.3> To: Subject: Earn a 100 K+ A Year!!! Date: Thu, 19 Aug 1999 00:35:14 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal

The Hottest Bus= iness Opportunity to Hit
the U.S. this Year!

This is not a MLM = Program !
Earn Full Time Inc= ome on a Part Time Basis !!!

New Photo Postcard vending machines which put you= r face on a postcard
are a smashing success throughout Europe.

Now for the first time these machines are ava= ilable in the U.S.
The U.S. market will grow to thousands of machines within the next
12-18 months according to industry experts. We are seeking qualified indiv= iduals
who are looking to take advantage of a virtually untapped market opportuni= ty in
their area. There are retail locations across the country ......waiting ! =

Timing is Everything !

We have developed the new self-service Personal P= ost Card to take advantage
of this dynamic market opportunity. Personal Post Cards combines the popul= arity
of the following markets:

Travel and Leisure Ma= rket $200 billion
Greeting Card $10 bil= lion
Photography $30 billio= n

The Opportunity Is:

Part or full time
No selling required No prior experience or= office required
All cash business!
Financing programs ava= ilable

For a Free Business Package at N= o Obligation:

1-888-852-7900
Please refer to Code F818 when you call.

Customer Service Opera= tors are available
Monday-Friday 9:00am - 9:00pm EST Saturday-Sunday 12:00 pm to 8 pm EST.

If you are outside the U.S. please fax your name, complete phone number including country code and a good time for us to call you to (954)236-7264= .
We will respond to your request as soon as possible.

This offer is not vali= d in all statesand should not be considered an offer
in states where the company is not registered.

If you no longer desir= e to receive email from us, please email us,
CLICK HERE.

The Hottest Business Opportunity to Hit

the U.S. thi= s Year!


This is not a MLM Program !


Earn Full Time Income on a Part Time Basis !!!

From searches@freeola.com Fri Oct 15 12:37:02 1999 Return-Path: Delivered-To: audit-lib@freebsd.org Received: from mailhub5.libertysurf.fr (mailhub5.libertysurf.fr [195.154.209.25]) by hub.freebsd.org (Postfix) with ESMTP id CF8B714D7F; Fri, 15 Oct 1999 12:36:52 -0700 (PDT) (envelope-from searches@freeola.com) Received: from mail.libertysurf.fr (ppp170-toulon.libertysurf.fr [213.36.56.170]) by mailhub5.libertysurf.fr (8.9.3/8.9.3) with SMTP id VAA20451; Fri, 15 Oct 1999 21:33:37 +0200 (CEST) From: searches@freeola.com Message-Id: <199910151933.VAA20451@mailhub5.libertysurf.fr> To: Friend@public.com Date: Fri, 15 Oct 99 20:52:42 EST Subject: Your Web Page Increase your Web Site visiblity ! Try out : *** Proven Web Page Optimisation Software *** >> Audited results 55% Number 1 90% top 5 << *** Macro Media Web Page Design Software **** >>> Make your Web Pages sparkle <<<< **** Accept checks from your Web Site ***** >>>> Improve your margins & Cashflow <<<< Go to : http://www.freebizlinks.net