This is a forwarded message From: Anton Rager <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Date: Thursday, December 20, 2001, 12:04:59 AM Linux distributions and /bin/login overflow ===8<==============Original message text=============== Hello, It seems that while Redhat Linux and Caldera Linux distributions are immune to the recent /bin/login environ overflow, other Linux distributions are not. Several Linux distributions install /bin/login with SysV login options enabled. Slackware 8.0 and lower [tested with 8.0, 4.0, 3.3] has SysV options enabled with /bin/login and is vulnerable. SuSE 6.1 has SysV options enabled with /bin/login and is vulnerable. I don't have a newer SuSE release, so others will need to verify. It would seem logical that SuSE 8.3 still includes the SysV login options enabled, and is probably vulnerable as well. Other distributions should be checked as well. A quick way to check for SysV option capabilities is to type "login", then enter "root testenv1=test" at the login: prompt. Supply your root passwd, and look for "testenv1" in the output of set. If it's set, then your copy of /bin/login supports SysV options.....and is probably vulnerable. Follow similar procedure to find overflow possibility/specifics ;) ----------------------------------------------------------- Si vous souhaitez vous desabonner de la mailing list, envoyez un mail a l'adresse: <[EMAIL PROTECTED]> contenant dans le Subject: du message le seul mot "unsubscribe". -----------------------------------------------------------
