Re: possible gnome-terminal/vte DoS?

On 18 Sep 2002, Havoc Pennington wrote:

>Date: 18 Sep 2002 10:04:29 -0400
>From: Havoc Pennington <[email protected]>
>To: [email protected]
>Content-Type: text/plain; charset=us-ascii
>List-Id: Discussion of the Red Hat Linux 'Limbo' beta
>    <limbo-list.redhat.com>
>Subject: Re: possible gnome-terminal/vte DoS?
>
>
>"Barry K. Nathan" <[email protected]> writes: 
>> Imagine an attacker with physical access to the keyboard and mouse but
>> not to the computer itself (the computer itself is physically secured).
>> The computer allows one person (at a time) to use it in person and also
>> allows other users to use it remotely via SSH.
>> 
>> Assume that Alice and Bob are connected to this system remotely and that
>> Charlie is using it in person. Charlie knows that Alice and Bob are
>> logged in (maybe he ran the "who" command, maybe he just finished a cell
>> phone conversation with one of them). Charlie, for some reason, wants to
>> annoy Alice and Bob. (Or, even if no remote access is possible, maybe he
>> just wants to take one computer out of commission temporarily and annoy
>> everyone else in the lab.) So he takes his open gnome-terminal, sets the
>> font size to 12000 and ka-boom.
>> 
>
>But a plain malloc bomb or fork bomb anyone can write would do the
>same - if you can run programs on a computer, you can always send its
>load through the roof.
>
>Anyway, will fix. Thanks for the bug report.

As an example to illustrate....

Save all important data open on your machine, and at a bash 
prompt type:

:(){ :|:&};:


-- 
Mike A. Harris		ftp://people.redhat.com/mharris
OS Systems Engineer
XFree86 maintainer
Red Hat Inc.