bugtraq - Still segfaults in man -k

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <17063.12823.952865.849967@mail.linux-delhi.org>
Date: Wed, 8 Jun 2005 23:29:51 +0530
From: Raj Mathur <raju@...ux-delhi.org>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>,
	bugtraq@...urityfocus.com
Subject: Still segfaults in man -k

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This was discussed earlier but in a different context: man -k tries to
execute a program called /unsafe/ when invoked with an argument
containing spaces.

Example: man -k 'a b'
sh: /unsafe/: No such file or directory
Error executing formatting or display command.
System command /unsafe/ exited with status 32512.

Execute attempt of /unsafe/ and segfault confirmed on Fedora Core 2
and Fedora Core 3.

No issues on Debian Sarge.

No issues on RH 7.3 and RHES3.

The earlier reports about /unsafe/ used a different vector as far as I
can see.  Apologies if it's the same bug.

Regards,

- -- Raju
- -- 
Raj Mathur                raju@...dalaya.org      http://kandalaya.org/
       GPG: 78D4 FC67 367F 40E2 0DD5  0FEF C968 D0EF CC68 D17F
                      It is the mind that moves
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Processed by Mailcrypt 3.5.8 <http://mailcrypt.sourceforge.net/>

iD8DBQFCpzGuyWjQ78xo0X8RAoz7AJ4lTAjMmzGCrAMaI7RDKFU/99MilQCeP1mx
4cEDvQafYxrUt6h94HdDIOc=
=GDk8
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/