[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID:
<ME2PR01MB365000DA73FDB83E1F5F5E5CEE87A@ME2PR01MB3650.ausprd01.prod.outlook.com>
Date: Tue, 6 Jan 2026 02:17:08 +0000
From: Peter Gutmann <pgut001@...auckland.ac.nz>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Buffer overflow in /bin/su from UNIX v4
Alan Coopersmith <alan.coopersmith@...cle.com> writes:
>https://sigma-star.at/blog/2025/12/unix-v4-buffer-overflow/ examines the
>source code for su.c and shows that the buffer for password input is a simple
>100 character array, but the loop to read password input has no boundary
>checks and will happily keep writing long past the end of the buffer.
It's also being discussed over on the Metzdowd cryptography list, including
people providing interesting historical perspectives. The thread starts here:
https://www.metzdowd.com/pipermail/cryptography/2026-January/039215.html
Not all messages are present in the archive yet.
Peter.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
