Date: Mon, 21 Sep 2015 16:43:46 +0000 From: David Holland <dholland-oss-security@...bsd.org> To: oss-security@...ts.openwall.com Subject: Re: s/party/hack like it's 1999 On Sun, Sep 20, 2015 at 06:26:31AM +0300, Solar Designer wrote: > > Note that all that was needed for this to happen was for a stray C2 > > byte from one writer to get injected just before the character-final > > 9B byte of a multibyte character from another writer. I specifically > > chose my example so that both writers output data which is well-formed > > and printable UTF-8, but that was not necessary. > > > > Since I see no reasonable application-side mitigation for this, I > > Yeah. A user's mitigation may be to avoid running multiple programs at > a time on a UTF-8 terminal. E.g. running "ps &" appears unsafe > (although is indeed unlikely to actually be used in a successful > attack), even if "ps" replaces control characters with question marks. I have been arguing for years (but without success) that vt bomb injection needs to be blocked in the tty driver. This problem (corruption of concurrent UTF-8 streams) needs to be too, as a matter of correctness and not even security. You can stty +tostop, but that won't really help very much. Sigh. -- David A. Holland dholland@...bsd.org
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.