Re: join bug

[Bob Proulx]

> Hello, I discovered a way to make the "join" command crash shells and
> make them completely non usable.  This can be used to make a small
> program and create a virus like situation.  If this program ran in
> console <no other virtual terminals> then it will make the local
> terminal completely worthless and only a reboot will fix the problem.  I
> have not tried it as root yet but I think it should have the same
> effects.

I find it extremely unlikely that a bug in join can be the cause of
your problem.  And almost by definition such a bug would exist in the
operating system kernel/tty driver instead to allow such behavior.
[See the old lock(1) command, password lock a terminal, for a
refutation of that statement.]  If one did exist it might be possible
to use in a denial of service attack.  But a method of distribution
would need to be found.  UNIX systems have traditionally been very
hard to penetrate with those types of attacks.  They generally operate
at a much higher level of security than other common systems such as
Microsoft Windows.  However without further information it is
impossible to do more than speculate.

My speculation is that join is running normally and waiting for an
end-of-file indication.  Usually either a control-D (end-of-file) or
a control-C (interrupt) will end the program and return to the shell.
However, those characters are user configurable and may be different
for your environment than in mine.  You would need to check your tty
driver settings with 'stty -a' and make sure you know your settings
for those functions.

> What do I do now?  How do I report this and to whom?

Security issues are, of course, a sensitive topic.  In my personal
opinion the bug list for the program in question is a good place to
discuss the problem.  It has a limited audience.  It is where the
experts on the program exist and can most quickly deal with the
problem.

> Finally if you do think that this is an important discovery that
> needs an update, will you give me the credit ( mention my name) for
> bringing this up :)? Note: this method has been tested on "join"
> versin 2.0 on a Linux machine running kernel 2.2.17·

Note that I am just another unix hacker and not the maintainer of
textutils.  But most generally contributors are included in the THANKS
files included with GNU packages.  But also note that you have to say
what your name is in order to get credit.  Your mail message had no
such information attached to it.  :-)

Bob