Bug 10338 - man overflow exploit.
man overflow exploit.
Status: CLOSED DUPLICATE of bug 9892
Product: Red Hat Linux
Classification: Retired
Component: man (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Bernhard Rosenkraenzer
: Security
Depends On:
  Show dependency treegraph
Reported: 2000-03-24 21:19 EST by zurk
Modified: 2008-05-01 11:37 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2000-03-24 21:36:03 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description zurk 2000-03-24 21:19:33 EST
A buffer overflow exists in the implementation of the 'man' program
 shipped with RedHat Linux, and other LInux vendors. By carefully
 crafting a long buffer of machine executable code, and placing it in the
 MANPATH environmental variable, it becomes possible for a would be
 attacker to gain egid man.
Comment 1 Bernhard Rosenkraenzer 2000-03-24 21:36:59 EST
This has been reported and fixed a couple of months ago.
We didn't release an errata package because it is non-critical; at the very
worst, someone getting gid man can present false man pages to users who access
the previously generated man page cache instead of rebuilding the man pages.

*** This bug has been marked as a duplicate of 9892 ***

Note You need to log in before you can comment on or make changes to this bug.