[10080] in bugtraq
tcpd remarks warning
daemon@ATHENA.MIT.EDU (Stefano Torricella)
Fri Apr 2 13:23:26 1999
Date: Fri, 2 Apr 1999 09:32:59 +0200
Reply-To: Stefano Torricella <thor@IRCITY.ORG>
From: Stefano Torricella <thor@IRCITY.ORG>
To: BUGTRAQ@NETSPACE.ORG
Hi,
Some days ago i've had a problem with tcpd 1.10 - patchlevel 7.6.
I suppose that the problem is in the parser routine but i haven't checked the source.
I try to describe the bug :
suppose you have an hosts.access or hosts.deny file like this
# hosts.deny
# some remarks
in.telnetd: 123.234.12.34, 98.76.54.32, \
32.198.76.54
...
now i want to remove 98.76.54.32 on the first line but i want the line
for remember or for restoring them later, so i duplicate the line and remarks the original
# hosts.deny
# some remarks
#in.telnetd: 123.234.12.34, 98.76.54.32, \
in.telnetd: 123.234.12.34, \
32.198.76.54
...
well in this manner i've removed all the address !!! because the \ on the end of
the remark line is treated how a continue of the normal line and in effect
the comment continue for the next line and all the above line until the first line
with the first char <> from space or tab !!
i think that when a remark line is found, the parser must go to the next line without checking
what is in the comment line.
if you write a simple shell program :
#!/bin/sh
# this is a comment \
echo "work !!"
the bash or the bourne shell ignore \ on the comment line !
Thinking that this is a general behavior for all the unix program i've contacted the author
and manteiner of tcpd but for him this is correct.
In all the case this may be dangerous so other sysadm may be interested on this behaviour
"bug" found in linux (debian 2.1 distribution but i think may other distribution are vulnerable)
OpenBSD 2.4 isn't vulnerable.
hope that this may help you ... and sorry for my rusted english ;-)
---
;---+---
bye|
bye|hor
