Red Hat Bugzilla – Bug 75414
talkd buffer overflow?
Last modified: 2015-03-04 20:11:31 EST
NetBSD released an advisory on talkd buffer overflow a day or two ago, check:
Quick look at netkit-ntalk code seems to indicate that a similar fix might be
necessary here too (also checked 0.18pre).
I also pinged the netkit maintainer, no reply at least yet.
The maintainer responded back:
It appears you may be right. I wonder how that slipped through.
However, the data in question comes from utmp. utmp is a trusted file.
Lots and *lots* of things are vulnerable if utmp is corrupted. And
this one (with a normal configuration) only gets you group tty, which
is less useful for hacking than group utmp.
This is not to say it shouldn't be fixed, and it will be... thanks for
If that analysis is correct this is not too grave a problem (who is using talkd
anyway??!?!? ;-), and will be fixed in upstream.
Closing bug because of analysis. :-)
Read ya, Phil