[15970] in bugtraq
i18n issues with format bugs
daemon@ATHENA.MIT.EDU (John Levon)
Wed Jul 26 15:41:43 2000
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-Id: <Pine.LNX.4.21.0007261604470.27538-100000@mrbusy.compsoc.man.ac.uk>
Date: Wed, 26 Jul 2000 16:12:39 +0100
Reply-To: John Levon <moz@COMPSOC.MAN.AC.UK>
From: John Levon <moz@COMPSOC.MAN.AC.UK>
To: BUGTRAQ@SECURITYFOCUS.COM
After discussion with David Wheeler (and I noticed some
on BUGTRAQ had also mentioned this) it seems that there is
the possibility of format problems for programs naively trusting
localised strings.
1) The GNU gettext source doesn't seem to be a problem, with the exception
of cat-compat.c, where bindtextdomain() checks the environment variable
$NLSPATH. The question is whether any software out there actually uses
this code any more
2) catgets() as specified in SuS can be used to retrieve arbitrary strings
via $NLSPATH. The SuS specification is here :
http://www.opengroup.org/onlinepubs/007908799/xsh/catopen.html
As it happens, the GNU libc ignores this environment variable in the
suid/sgid case. I don't know whether this also applies to other vendor's
implementations ?
I don't actually have a specific piece of code that's under risk, but it
seems that in general catgets() and friends cannot be trusted. Of course,
all the code out there doesn't trust outside functions anyway, right ?
john
