Bug#129104: cgiemail: buffer overflow and script reading vulnerabilities

2002-04-08 Thread Thomas Smith
On Mon, Apr 08, 2002 at 02:50:18PM -0500, Colin Watson wrote: > Better fixes are available, though. I'd forgotten that the last > message in this bug left it up to me to test them ... I'll have a look > today or tomorrow and see if we can get this sorted. > > -- Colin Watson [EMAIL PROTECTED] Ther

Bug#129104: bug 129104 (buffer overflow + template reading in cgiemail)

2002-03-12 Thread Thomas Smith
ok, written. not especially nice, but written. http://finbar.dyndns.org/~tgs/deb/ it does not ask me the question, i'm not sure if that's because i have my priority set to high or if it's actually broken. so, go ahead and test... have fun, and thank you. thomas -- Thomas "resc" Smith <[EMAIL

Bug#129104: bug 129104 (buffer overflow + template reading in cgiemail)

2002-03-11 Thread Thomas Smith
On Sun, Mar 10, 2002 at 02:27:51AM +, Colin Watson wrote: > Hi, > > Any progress with this cgiemail bug? If you've got the debconf stuff > written, I could test it if that would help ... I worked on it significantly today, and will finish it tomorrow. This is my spring break, so I finally hav

Bug#129104: bug 129104 (buffer overflow + template reading in cgiemail)

2002-02-12 Thread Thomas Smith
I thought of a way not to break compatability: if there's no config file, have it act like it did before. Here's a patch. --- tmp/cgiemail-1.6/cgilib.c Tue Feb 12 17:09:45 2002 +++ cgiemail-1.6/cgilib.c Tue Feb 12 17:08:32 2002 @@ -475,15 +475,7 @@ cfp = fopen(TEMPLATECONF, "r"); i

Bug#129104: bug 129104 (buffer overflow + template reading in cgiemail)

2002-01-20 Thread Thomas Smith
On Thu, Jan 17, 2002 at 04:42:42PM +, Colin Watson wrote: > On Wed, Jan 16, 2002 at 04:17:25PM -0500, Thomas Smith wrote: > > Hmm, one problem that just occurred to me is that we can't easily make > > the location of the template files a compile-time option because people &

Bug#129104: bug 129104 (buffer overflow + template reading in cgiemail)

2002-01-16 Thread Thomas Smith
Hello, thank you for helping/offering to help! I had released a new version with an almost-correct fix for the buffer overflow problem last night, and just looked at your mail to the bug this afternoon. My fix was almost the same as yours; it used CGI_ERRMSG_MAX-1 instead of CGI_ERRMSG_MAX. My n