[5035] in bugtraq
Re: Multiply bugs in MH-6.8.3 (Mail Handler program)
daemon@ATHENA.MIT.EDU (nolander@NOLANDER.PP.SE)
Mon Jul 28 16:29:07 1997
Date: Mon, 28 Jul 1997 21:47:27 +0200
Reply-To: nolander@NOLANDER.PP.SE
From: nolander@NOLANDER.PP.SE
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: <33DA915F.35ED2B71@onlinex.net>
> Okay there is an overflow in MH-6.8.3, which is suid, which I THINK (not
> sure), is installed, at least in Redhat 4.1+, by default (I think this
> char *hdir, buf[BUFSIZ], *tmp;
> purposes if you try to
> overflow this...just use a size
> of 9999, just to see if it
> segfaults.
>
> hdir = getenv("HOME");
> if (hdir == NULL)
> hdir = ".";
> (void) sprintf(buf, "%s/.netrc", hdir);
All this was in ruserpass.c...
ruserpass(host,&user,&pass); is found in msgchk.c, in checkremote() or
something like that... meaning that the host aren't vulnerable if not
configured.. this is from a system where mh was installed w/o being
configured (default)
[nolander@sangis nolander]$ /usr/bin/mh/msgchk -host muroff
msgchk: no servers available
check mana mh-tailor for more info about this server stuff :)
