Re: Solaris /usr/lib/exrecover buffer overflow

[Florian Weimer]

Pablo Sor <[EMAIL PROTECTED]> writes:

> The /usr/lib/exrecover contains a buffer overflow
> (this command is suid in Solaris 2.4/5/6)

This buffer overflow is probably not specific to Solaris, but already
contained in the original AT&T/UCB vi sources.  It seems as if
exrecover never was designed to be installed setuid root.

--
Florian Weimer                    [EMAIL PROTECTED]
University of Stuttgart           http://cert.uni-stuttgart.de/
RUS-CERT                          +49-711-685-5973/fax +49-711-685-5898