Package: acon Version: 1.0.5-7 Severity: critical Tags: security
In addition to the security bug mentioned in #475733, there are four buffer overflows that I have found.
acon.c:53 (already reported) and child.c:104A very large value of $HOME can create a buffer overflow with sprintf. Use snprintf instead. menu.c:100, menu.c:221, menu.c:243 On terminals with greater than 211 columns (like some framebuffers), the buffer line will be overflowed, since it only has 400 bytes of space. ((getmaxx()-10)*2)-2 > 400
These are critical due to the local root exploit contained in #475733. Once the setuid bug is fixed, these will become grave.
There may be more. I have gone through the code as thoroughly as I could, but the code is barely legible and uses lots of fixed-sized buffers. For these reasons, it is my recommendation that acon not be included in a stable release.
-- System Information: Debian Release: lenny/sid APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 2.6.25-rc8-amd64 (SMP w/2 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8) Shell: /bin/sh linked to /bin/dash -- brian m. carlson / brian with sandals: Houston, Texas, US +1 713 440 7475 | http://crustytoothpaste.ath.cx/~bmc | My opinion only troff on top of XML: http://crustytoothpaste.ath.cx/~bmc/code/thwack OpenPGP: RSA v4 4096b 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187
signature.asc
Description: Digital signature
