[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <37aacb54-8bcf-4b7e-a747-6ff3ec8143c5@oracle.com>
Date: Fri, 20 Mar 2026 16:41:51 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: Buffer overflow in /bin/su from UNIX v4
On 1/5/26 09:27, Alan Coopersmith wrote:
> Late last year, a tape was found containing the only known copy of Bell Labs
> Research Unix Version 4 from 1973 - the version in which UNIX was rewritten
> from assembly into the then-new C programming language. Since then a number
> of folks have been running the recovered software in PDP-11 simulators.
>
> https://sigma-star.at/blog/2025/12/unix-v4-buffer-overflow/ examines the
> source code for su.c and shows that the buffer for password input is a
> simple 100 character array, but the loop to read password input has no
> boundary checks and will happily keep writing long past the end of the
> buffer.
This has been assigned CVE-2025-71263 now:
https://www.cve.org/CVERecord?id=CVE-2025-71263
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
