On Mon, 25 May 2009 19:06:39 +0000 Michael Shalayeff <mic...@lucifier.net> wrote:
> On Mon, May 25, 2009 at 07:27:03PM +0200, rembrandt wrote: > > "login" is proune to a local DoS when somebody press the arrowkey > > serval times at the "login:" screen (no problem for the password field). > > first of all login(1) does not handle login: prompt. > getty(8) does. i suppose you wanna look in the getty then? Well after looking to login.c it looks ot me that it would be logical to filter it there. But I will take a look at the getty-source if you recomment it. The problem could get descriped like: If you press multiple times the arrow key your tty becomes unuseable for serval minutes. login: <arrowkeys> You will also noice that the cursor moves and if it stops to move your tty is "locked"(DoS, wait serval minutes). I found no way to inject something this way (would be funny imho..) but the tty dies for some minutes... Try it out on any OpenBSD you like. That was reported multiple times to OpenBSD. So I thought it might be about time to fix it. :-) Related to the password-field it allows you still to make very secure passwords so I would not like to filter the input for this field. Also there it does not "DoS" the tty. Kind regards, Rembrandt
