oss-security - Re: GNU ed heap overflow

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Thu, 04 Sep 2008 22:44:47 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: GNU ed heap overflow

* Steven M. Christey:

> On Mon, 1 Sep 2008, Florian Weimer wrote:
>
>> Interesting.  But this type of command execution is not possible with
>> "red", which suffers from the same overflow.
>
> Does red share the same codebase as ed?  Or is a separate CVE necessary?

lrwxrwxrwx 1 root root 7 2008-08-31 11:36 /usr/bin/red -> /bin/ed

It's "restricted ed" in the sense of "restriced bash" etc.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.