From adrian@cougar.aceonline.com.au Sun Feb 16 18:11:57 1997 Return-Path: Received: from cougar.aceonline.com.au (adrian@cougar.aceonline.com.au [203.103.81.36]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id SAA14187 for ; Sun, 16 Feb 1997 18:11:55 -0800 (PST) Received: from localhost (adrian@localhost) by cougar.aceonline.com.au (8.8.4/8.7) with SMTP id KAA13140 for ; Mon, 17 Feb 1997 10:12:44 +0800 Date: Mon, 17 Feb 1997 10:12:44 +0800 (WST) From: Adrian Chadd To: audit-telnetd@freebsd.org Subject: Re : where are we? Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Hi David. Just wondering if you had started telnetd and if so, where you were up to. Cya. -- Adrian Chadd | Windows 95 - the XT emulator for | your 486 and above! | Being superstitious is bad luck. From davidn@labs.usn.blaze.net.au Mon Feb 17 19:35:21 1997 Return-Path: Received: from labs.usn.blaze.net.au (labs.usn.blaze.net.au [203.17.53.30]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id TAA10144 for ; Mon, 17 Feb 1997 19:35:17 -0800 (PST) Received: (from davidn@localhost) by labs.usn.blaze.net.au (8.8.5/8.8.5) id OAA26156; Tue, 18 Feb 1997 14:34:54 +1100 (EST) Message-ID: <19970218143454.43215@usn.blaze.net.au> Date: Tue, 18 Feb 1997 14:34:54 +1100 From: David Nugent To: Adrian Chadd Cc: audit-telnetd@freebsd.org Subject: Re: Re : where are we? References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.61 In-Reply-To: ; from Adrian Chadd on Feb 02, 1997 at 10:12:44AM On Feb 02, 1997 at 10:12:44AM, Adrian Chadd wrote: > Hi David. Just wondering if you had started telnetd and if so, where you > were up to. Hi Adrian, No, I haven't actually started work on it, but I had in mind some specific fixes when I told Jordon about it. They will require some restructuring of a few of the functions, namely those in utility.c (putf() and friends). If you wish to attack telnetd sooner, then go right ahead and see what else is there. You'll probably find right off that putf() could cause buffer overlow since it does no length checking on one of its arguments (the destination buffer). This is the part I need to fix by restructuring. Incidently, the overflow here is in the data area and not on the stack, and the data in question comes from system config files rather than the user, so the real risk of it causing problems is minimal - but the code could be done better (getty(8), for example, has similar code, but not the same problem). I'll probably start hacking at it within the next few days. I just need to get another project off my back first. :-) Regards, David Nugent - Unique Computing Pty Ltd - Melbourne, Australia Voice +61-3-9791-9547 Data/BBS +61-3-9792-3507 3:632/348@fidonet davidn@freebsd.org davidn@blaze.net.au http://www.blaze.net.au/~davidn/ From adrian@cougar.aceonline.com.au Wed Feb 19 21:23:35 1997 Return-Path: Received: from cougar.aceonline.com.au (adrian@cougar.aceonline.com.au [203.103.81.36]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id VAA17975 for ; Wed, 19 Feb 1997 21:23:32 -0800 (PST) Received: from localhost (adrian@localhost) by cougar.aceonline.com.au (8.8.4/8.7) with SMTP id NAA30687 for ; Thu, 20 Feb 1997 13:23:41 +0800 Date: Thu, 20 Feb 1997 13:23:41 +0800 (WST) From: Adrian Chadd To: audit-telnetd@freebsd.org Subject: Re : Telnetd. Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Ok - I'm going to start on telnetd this afternoon. Cya. -- Adrian Chadd | Windows 95 - the XT emulator for | your 486 and above! | Being superstitious is bad luck. From adrian@cougar.aceonline.com.au Thu Feb 20 02:11:49 1997 Return-Path: Received: from cougar.aceonline.com.au (adrian@cougar.aceonline.com.au [203.103.81.36]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id CAA03653; Thu, 20 Feb 1997 02:11:47 -0800 (PST) Received: from localhost (adrian@localhost) by cougar.aceonline.com.au (8.8.4/8.7) with SMTP id SAA16485; Thu, 20 Feb 1997 18:11:58 +0800 Date: Thu, 20 Feb 1997 18:11:57 +0800 (WST) From: Adrian Chadd To: audit-telnetd@freebsd.org cc: auditors@freebsd.org Subject: Patch for utility.c in telnetd.. Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Here is a patch for a couple of blantantly obvious (to me) possible buffer overflow problems. From what I could see from the source, putstr() isn't used for anything bigger than BUFSIZ, so thats my assumption. If anyone thinks I should, I can change it to accept a maxlength parameter. Try it out, tell me if ity works or not, and if its any use at all. Cya. -- Adrian Chadd | Windows 95 - the XT emulator for | your 486 and above! | Being superstitious is bad luck. diff - utility.c 396a397 > int index = 0; 398c399,403 < while (*s) --- > while (*s) { > index++; > if (index > BUFSIZ) { > err(1,"putstr(): overflow in string length.\n"); > } 399a405 > } 427c433,435 < char db[100]; --- > char db[BUFSIZ]; > int index; > 441a450 > index = 0; 444,445c453,463 < putchr(*cp++); < continue; --- > if (index > BUFSIZ) { > err(1, "putf() : overflow in while (*cp)\n"); > } else { > putchr(*cp++); > index++; > continue; > } > } > index++; > if (index > BUFSIZ) { > err(1, "putf() : overflow in switch (*+cpp)\n"); From adrian@cougar.aceonline.com.au Thu Feb 20 02:40:50 1997 Return-Path: Received: from cougar.aceonline.com.au (adrian@cougar.aceonline.com.au [203.103.81.36]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id CAA05053; Thu, 20 Feb 1997 02:40:47 -0800 (PST) Received: from localhost (adrian@localhost) by cougar.aceonline.com.au (8.8.4/8.7) with SMTP id SAA18397; Thu, 20 Feb 1997 18:40:58 +0800 Date: Thu, 20 Feb 1997 18:40:58 +0800 (WST) From: Adrian Chadd To: audit-telnetd@freebsd.org cc: auditors@freebsd.org Subject: Re : util.c patch whoops.. Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sorry guys - here is the patch again using diff -c. -- Adrian Chadd | Windows 95 - the XT emulator for | your 486 and above! | Being superstitious is bad luck. *** utility.c.orig Thu Jan 4 04:33:26 1996 --- utility.c Thu Jan 4 03:58:40 1996 *************** *** 394,402 **** putstr(s) register char *s; { ! while (*s) putchr(*s++); } void --- 394,408 ---- putstr(s) register char *s; { + int index = 0; ! while (*s) { ! index++; ! if (index > BUFSIZ) { ! err(1,"putstr(): overflow in string length.\n"); ! } putchr(*s++); + } } void *************** *** 424,430 **** { char *slash; time_t t; ! char db[100]; #ifdef STREAMSPTY extern char *index(); #else --- 430,438 ---- { char *slash; time_t t; ! char db[BUFSIZ]; ! int index; ! #ifdef STREAMSPTY extern char *index(); #else *************** *** 439,448 **** putlocation = where; while (*cp) { if (*cp != '%') { ! putchr(*cp++); ! continue; } switch (*++cp) { --- 447,466 ---- putlocation = where; + index = 0; while (*cp) { if (*cp != '%') { ! if (index > BUFSIZ) { ! err(1, "putf() : overflow in while (*cp)\n"); ! } else { ! putchr(*cp++); ! index++; ! continue; ! } ! } ! index++; ! if (index > BUFSIZ) { ! err(1, "putf() : overflow in switch (*+cpp)\n"); } switch (*++cp) { From davidn@labs.usn.blaze.net.au Thu Feb 20 02:52:32 1997 Return-Path: Received: from labs.usn.blaze.net.au (labs.usn.blaze.net.au [203.17.53.30]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id CAA05556 for ; Thu, 20 Feb 1997 02:52:28 -0800 (PST) Received: (from davidn@localhost) by labs.usn.blaze.net.au (8.8.5/8.8.5) id VAA22445; Thu, 20 Feb 1997 21:20:23 +1100 (EST) Message-ID: <19970220212022.19590@usn.blaze.net.au> Date: Thu, 20 Feb 1997 21:20:22 +1100 From: David Nugent To: Adrian Chadd Cc: audit-telnetd@freebsd.org Subject: Re: Patch for utility.c in telnetd. References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.61 In-Reply-To: ; from Adrian Chadd on Feb 02, 1997 at 06:11:57PM On Feb 02, 1997 at 06:11:57PM, Adrian Chadd wrote: > Here is a patch for a couple of blantantly obvious (to me) possible buffer > overflow problems. From what I could see from the source, putstr() isn't > used for anything bigger than BUFSIZ As I wrote previously, don't bother with this particular problem. I'll be rewriting most of utility.c, and it won't need a size parameter since instead of formatting to a buffer, it will be taking care of output itself. Regards, David Nugent - Unique Computing Pty Ltd - Melbourne, Australia Voice +61-3-9791-9547 Data/BBS +61-3-9792-3507 3:632/348@fidonet davidn@freebsd.org davidn@blaze.net.au http://www.blaze.net.au/~davidn/ From dillon@flea.best.net Thu Feb 20 11:53:53 1997 Return-Path: Received: from who.cdrom.com (who.cdrom.com [204.216.27.3]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id LAA03783; Thu, 20 Feb 1997 11:53:53 -0800 (PST) Received: from flea.best.net (root@flea.best.net [206.184.139.131]) by who.cdrom.com (8.7.5/8.6.11) with ESMTP id LAA24859 ; Thu, 20 Feb 1997 11:53:52 -0800 (PST) Received: (from dillon@localhost) by flea.best.net (8.8.5/8.8.3) id LAA12949; Thu, 20 Feb 1997 11:51:58 -0800 (PST) Date: Thu, 20 Feb 1997 11:51:58 -0800 (PST) From: Matt Dillon Message-Id: <199702201951.LAA12949@flea.best.net> To: Adrian Chadd Cc: audit-telnetd@freebsd.org, auditors@freebsd.org Subject: Re: Re : util.c patch whoops.. I'm not sure I understand the problem. Where's the buffer overflow ? -Matt :Sorry guys - here is the patch again using diff -c. : : :-- :Adrian Chadd | Windows 95 - the XT emulator for : | your 486 and above! : | Being superstitious is bad luck. : :*** utility.c.orig Thu Jan 4 04:33:26 1996 :--- utility.c Thu Jan 4 03:58:40 1996 :*************** :*** 394,402 **** : putstr(s) : register char *s; : { : :! while (*s) : putchr(*s++); : } Matthew Dillon Engineering, BEST Internet Communications, Inc. [always include a portion of the original email in any response!] From dillon@flea.best.net Thu Feb 20 12:01:54 1997 Return-Path: Received: from flea.best.net (root@flea.best.net [206.184.139.131]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id MAA04444; Thu, 20 Feb 1997 12:01:54 -0800 (PST) Received: (from dillon@localhost) by flea.best.net (8.8.5/8.8.3) id LAA13189; Thu, 20 Feb 1997 11:59:44 -0800 (PST) Date: Thu, 20 Feb 1997 11:59:44 -0800 (PST) From: Matt Dillon Message-Id: <199702201959.LAA13189@flea.best.net> To: Adrian Chadd Cc: audit-telnetd@freebsd.org, auditors@freebsd.org Subject: Re: Re : util.c patch whoops.. Oh, I see the problem.. (slaps hand on head). Ick. All of that for just a single call to putf() in telnetd.c ? It looks like the telnetd code stole putf() from getty, but then replaced the flushable buffer with a static one. Only one routine appears to even *call* putf in telnetd: if (hostinfo && *IM) putf(IM, ptyibuf2); -Matt :Sorry guys - here is the patch again using diff -c. : : :-- :Adrian Chadd | Windows 95 - the XT emulator for : | your 486 and above! : | Being superstitious is bad luck. : :*** utility.c.orig Thu Jan 4 04:33:26 1996 :--- utility.c Thu Jan 4 03:58:40 1996 :*************** :*** 394,402 **** : putstr(s) : register char *s; : { : :! while (*s) : putchr(*s++); : } : : void :--- 394,408 ---- : putstr(s) : register char *s; : { :+ int index = 0; : :... Matthew Dillon Engineering, BEST Internet Communications, Inc. [always include a portion of the original email in any response!] From mazal@netvision.net.il Tue Sep 1 13:39:30 1998 Return-Path: Received: from P1 ([192.117.232.9]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id NAA19661 for ; Tue, 1 Sep 1998 13:39:16 -0700 (PDT) (envelope-from mazal@netvision.net.il) From: mazal@netvision.net.il Received: from default - 192.117.233.58 by isdn.net.il with Microsoft SMTPSVC; Tue, 1 Sep 1998 23:22:56 +0300 Date: Tue, 01 Sep 1998 23:25:28 +0300 Sender: mazal@netvision.net.il Subject: US$ 120.000.000 de Dolares To: audit-telnetd@freebsd.org X-Mailer: Message-ID: <0a95d5622200198P1@isdn.net.il> Estimado navegante: US$ 120.000.000 lo esperan en: http://209.75.79.87/mazal y un tentador regalo para el espiritu en: http://209.75.79.87/tierra Nunca su bolsillo y su espiritu estuvieron tan cerca de enriquecerse. Gracias por su atencion.- R.M. Srul Mazal Israel Ltd mazal7@aquanet.co.il From print2live@angelfire.com Sat Mar 20 19:03:35 1999 Delivered-To: audit-telnetd@freebsd.org Received: from server2525 (ip157.moorestown4.nj.pub-ip.psi.net [38.26.85.157]) by hub.freebsd.org (Postfix) with SMTP id 38DA615227 for ; Sat, 20 Mar 1999 19:03:27 -0800 (PST) (envelope-from print2live@angelfire.com) To: From: Subject: AD:Family Reunion T Shirts & More Date: Sat, 20 Mar 1999 18:28:19 Return-Path: Message-Id: <19990321030329.38DA615227@hub.freebsd.org> Message sent by: Kuppler Graphics, 32 West Main Street, Maple Shade, New Jersey, 08052, 1-800-810-4330. This list will NOT be sold. All addresses are automatically added to our remove list. Hello. My name is Bill from Kuppler Graphics. We do screenprinting on T Shirts, Sweatshirts, Jackets, Hats, Tote Bags and more! Do you or someone you know have a Family Reunion coming up? Kuppler Graphics would like to provide you with some great looking T Shirts for your Reunion. Kuppler Graphics can also provide you with custom T's and promotional items such as imprinted magnets, keychains, pens, mugs, hats, etc. for your business or any fundraising activity (church, school, business etc.) We also can provide you with quality embroidery. We are a family owned company with over 15 years of experience. All work is done at this location. No middle man. Our prices are great! Click reply to email us or call 1-800-810-4330 for more info Bill Kuppler Graphics From remailer@replay.com Sun Mar 28 16:58:30 1999 Return-Path: Delivered-To: audit-telnetd@freebsd.org Received: from unknown (1Cust90.tnt3.atl2.da.uu.net [153.36.17.90]) by hub.freebsd.org (Postfix) with SMTP id 4120115588; Sun, 28 Mar 1999 16:58:24 -0800 (PST) (envelope-from remailer@replay.com) From: Subject: toner sales advertising Date: Mon, 29 Mar 1999 04:33:14 Message-Id: <19990329005825.4120115588@hub.freebsd.org> BENCHMARK PRINT SUPPLY LASER PRINTER CARTRIDGES JUST FOR YOU AS WELL AS FAX AND COPIER TONER CHECK OUT THESE NEW PRINT CARTRIDGE PRICES : APPLE LASER WRITER PRO 600 OR 16/600 $69 LASER WRITER SELECT 300,310.360 $64 LASER WRITER 300, 320, 360 $54 LASER WRITER LS,NT,2NTX,2F,2G & 2SC $54 LASER WRITER 12/640 $79 HEWLETT PACKARD LASERJET SERIES 2,3 & 3D $49 LASERJET SERIES 2P AND 3P $54 LASERJET SERIES 3SI AND 4SI $75 LASERJET SERIES 4L AND 4P $49 LASERJET SERIES 4, 4M, 5, 5M $59 LASERJET SERIES 4000 HIGH YIELD $99 LASERJET SERIES 4V $95 LASERJET SERIES 5SI , 8000 $95 LASERJET SERIES 5L AND 6L $49 LASERJET SERIES 5P, 5MP, 6P, 6MP $59 LASERJET SERIES 5000 $89 HP LASERFAX LASERFAX 500, 700, FX1, $59 LASERFAX 5000, 7000, FX2, $59 LASERFAX FX3 $69 LASERFAX FX4 $79 LEXMARK OPTRA 4019, 4029 HIGH YIELD $135 OPTRA R, 4039, 4049 HIGH YIELD $135 OPTRA S 4059 HIGH YIELD $135 OPTRA E $59 OPTRA N $115 EPSON EPL-70000, 8000 $105 EPL-1000, 1500 $105 CANON LBP-430 $49 LBP-460, 465 $59 LBP-8 II $54 LBP-LX $54 LBP-MX $95 LBP-AX $49 LBP-EX $59 LBP-SX $49 LBP-BX $95 LBP-PX $49 LBP-WX $95 LBP-VX $59 CANON FAX L700 THRU L790 FX1 $59 CANONFAX L5000 L70000 FX2 $59 CANON COPIERS PC 20, 25 ETC.... $89 PC 3, 6RE, 7, 11 (A30) $69 PC 320 THRU 700 (E40) $89 NEC SERIES 2 LASER MODEL 95 $105 PLACE YOUR ORDER BY : PHONE 770-399-0953 FAX: 770-698-9700 E-MAIL: BENCHMARK1@USA.NET WITH SUBJECTLINE: ORDER MAIL: 1091 REDSTONE LANE, ATLANTA GA 30338 MAKE SURE YOU INCLUDE THE FOLLOWING INFORMATION IN YOUR ORDER: 1) PHONE NUMBER 2) COMPANY NAME 3) SHIPPING ADDRESS 4) YOUR NAME 5) ITEMS NEEDED WITH QUANTITIES 6) METHOD OF PAYMENT. (COD OR CREDIT CARD) 7) CREDIT CARD NUMBER WITH EXPIRATION DATE WE SHIP UPS GROUND STANDARD. ADD $4.5 FOR SHIPPING AND HANDLING. FOR ORDER QUESTIONS CALL 770-399-0953 FOR CUSTOMER SERVICE 770-399-5505 FOR E-MAIL REMOVAL USE: BENCHMARK2@USA.NET OR CALL 770-399-5614 From workshop@npcollege-edu.net Sun Jul 4 16:01:38 1999 Return-Path: Delivered-To: audit-telnetd@freebsd.org Received: from npcollege-edu.net (mail.npcollege-edu.net [209.232.226.194]) by hub.freebsd.org (Postfix) with SMTP id B04C21517B; Sun, 4 Jul 1999 16:01:33 -0700 (PDT) (envelope-from workshop@npcollege-edu.net) From: Subject: Re: Deleting Your Address. Date: Sun, 4 Jul 1999 12:36:31 Message-Id: <614.324265.434363@npcollege-edu.net> From:The SFSE(Scientific Facts Search Engine). When you send an email to EDU,R&D,or Job sites,your email might be forwarded via the SFSE to find the info you are looking for. The NU(NewAmerica University)has received a copy of your email,but the date is Feb/25/99.Do you still need this info? To refresh your memory you can go again to the NU website and look for these topics: "The Redeemat has solved all environmental problems"-"The 9% Producer Fee would eliminate crime & taxes within 3 years"-"The free NHRI (National Health & Retirement Insurance")- "The job guarantee system(JIC/Job Insurance Corporation)"and "The list of 22nd Centurys' products & businesses available right now". Or,request for the records of the SFSE search by putting in the subject REQUESTING INFO and click REPLY. Or,in the future send "REQUEST FOR SEARCH" (on any topic) directly to SFSE, and they will do the search for you,put in the subject SFSE. Or,please allow us to DELETE your address permanently by simply clicking REPLY. B.Morrison workshop@npcollege-edu.net From searches@freeola.com Fri Oct 15 12:37:02 1999 Return-Path: Delivered-To: audit-telnetd@freebsd.org Received: from mailhub5.libertysurf.fr (mailhub5.libertysurf.fr [195.154.209.25]) by hub.freebsd.org (Postfix) with ESMTP id CF8B714D7F; Fri, 15 Oct 1999 12:36:52 -0700 (PDT) (envelope-from searches@freeola.com) Received: from mail.libertysurf.fr (ppp170-toulon.libertysurf.fr [213.36.56.170]) by mailhub5.libertysurf.fr (8.9.3/8.9.3) with SMTP id VAA20451; Fri, 15 Oct 1999 21:33:37 +0200 (CEST) From: searches@freeola.com Message-Id: <199910151933.VAA20451@mailhub5.libertysurf.fr> To: Friend@public.com Date: Fri, 15 Oct 99 20:52:42 EST Subject: Your Web Page Increase your Web Site visiblity ! Try out : *** Proven Web Page Optimisation Software *** >> Audited results 55% Number 1 90% top 5 << *** Macro Media Web Page Design Software **** >>> Make your Web Pages sparkle <<<< **** Accept checks from your Web Site ***** >>>> Improve your margins & Cashflow <<<< Go to : http://www.freebizlinks.net