Re: Release-critical Bugreport for November 26, 1999

[Joel Klecker <jk@espy.org>]

At 13:16 +1100 1999-11-28, Herbert Xu wrote:
>>> Package: libc6 (main)
>>> Maintainer: Joel Klecker <debian-glibc@lists.debian.org>
>>>   21810  libc6: rexec call dumps core with user="string" and password=NULL
>
>> Need some more examination to find a solution, that doesn't open a
>> security hole.
>
>AFAIK, there aren't any security implications here if the strategy is to
>copy the libc5 behaviour (my preference).

There is no strategy, this bug is not gonna be "fixed" unless upstream
agrees. Upstream says the bug is in the BSD man page for rexec(3), which
claims a behavior that the source for the function doesn't have.
-- 
Joel Klecker (aka Espy)                    Debian GNU/Linux Developer
<URL:mailto:jk@espy.org>                 <URL:mailto:espy@debian.org>
<URL:http://web.espy.org/>               <URL:http://www.debian.org/>