Re: vixie cron possible local root compromise

[Andrew Brown]

>When crontab has determined the name of the user calling crontab (using
>getpwuid()),
>the login name is stored in a 20 byte buffer using the strcpy() function
>(which does no bounds checking). 'useradd' (the utility used to add users
>to the system)
>however allows usernames of over 20 characters (32 at most on my distribution).

i can see how this is an "issue", but don't you already have to be
root to get a user name longer than 20 characters?  or are you just
assuming that some admins out there will fail to balk at such a
strange request?

--
|-----< "CODE WARRIOR" >-----|
[EMAIL PROTECTED]             * "ah!  i see you have the internet
[EMAIL PROTECTED] (Andrew Brown)                that goes *ping*!"
[EMAIL PROTECTED]       * "information is power -- share the wealth."