On 5/16/05, Uwe Hermann <uwe@xxxxxxxxxxxxxx> wrote:
> Hi all,
>
> I have found a possible security issue in a setuid root program today.
> Using some well-crafted commandline parameters I can force the application
> to segfault. I analyzed this a bit further and found out that the segfault
> is triggered by a strlen(x) call where x is NULL.
I'd consider it a security vulnerability on the basis that according
to the C standard the behaviour of strlen(NULL) is undefined so
literally anything could happen (for example allowing the user to gain
read access to secret infromation in memory),
Imran
|
