4 ms·

I'd love to hear the backstory. Who on _earth_ goes looking for vulnerabilities in beep?!

• netsec_burn 9y ago
  I was looking into this the other day. It was the original developer of the tool who found the vulnerability in it.
• alxlaz 9y ago
  If I had to guess, I'd say they were doing it because it is often installed with suid root. Edit: also, there's a challenge about this in the program's README :-) "Decide for yourself, of course, but it looks safe to me - there's only one buffer and fgets doesn't let it overflow, there's only one file opening, and while there is a potential race condition there, it's with /dev/console. If someone can exploit this race by replacing /dev/console, you've got bigger problems. :)"
  • DCoder 9y ago
    It should be pointed out that the README is wrong about the race condition – it is not limited to /dev/console, you can use the -e option to point it to a different output device.
    • jwilk 9y ago
      It doesn't open /dev/console by default either (the default device is /dev/tty0). I don't see where the race condition is, though.
• jwilk 9y ago
  I wouldn't assume that someone was actively looking for vulnerabilities there. Perhaps a user got curious how is this implemented, looked at the source, and was horrified with what they saw.