Subject: Re: iDEFENSESecurityAdvisory02.10.04: XFree86FontInformationFileBufferOverflow From: Steffen Kluge <kluge@fujitsu.com.au> Date: Tue, 17 Feb 2004 11:45:31 +1100 To: bugtraq@securityfocus.com On Sat, 2004-02-14 at 19:58, Dr Andrew C Aitchison wrote: >> I note that this code also ocurs in Xvnc, The version of Xvnc I've tried behaves somewhat differently, though: $ perl -e 'print "0" x 1024 . "A" x 96 . "\n"' > fonts.alias $ Xvnc :10 -fp . 17/02/04 11:28:28 Xvnc version 3.3.3r2+tight1.2.4 17/02/04 11:28:28 Copyright (C) AT&T Laboratories Cambridge. 17/02/04 11:28:28 All Rights Reserved. 17/02/04 11:28:28 See http://www.uk.research.att.com/vnc for information on VNC 17/02/04 11:28:28 Desktop name 'x11' (my.host:10) 17/02/04 11:28:28 Protocol version supported 3.3 17/02/04 11:28:28 Listening for VNC connections on TCP port 5910 failed to set default font path '.' Fatal server error: could not open default font 'fixed' No signals are caught. Also, Xvnc doesn't need to be suid, and usually isn't. Cheers Steffen.
.
re
Гм. Вообще в чём проблема?
Для vnc-3.3.3r2-alt7 тест проходит точно так же, как для tightvnc в процитированном письме; SUID тоже нет.
Да похоже это устарело