A Strang bug using Ctrl-N, perhaps a way to deny service on a shell

["Ben Allen" <ocean () northlink net>]

(This is a post that I sent to BugTraq)
I've found a bug. I'm not sure what the bug is in. Since it is so widely
found I can't find out what it is.
For an example telnet into any SMTP server you like from a unix prompt.
I've only tested from OpenBSD 3.0 Current. Now enter this is:
^N^N^N
<Return>
^N
<Return>
^N

^N is equivalent to Ctrl-N. If it doesn't work add a few more ^N
<returns> at the end.
This then turns any input and some output into strange characters. Now
if you copy and paste these strange symbols into a word processor and it
will paste the normal text into it. I did this with Microsoft word and
copying it from SecureCRT. Now this in its self isn't a real problem
other then an annoyance, but if you had a local messaging type program
say coded in shell script and if it printed the exact message back to
you. It could in turn screw up your ability to tell what you where
typing. I know of a program called send made by admin of a free shell
server that I'm a member of that can produce this affect. If you want
source code to that program send me an email and I'll get you a copy.
I'm not sure if this is a bug in the emulation that I'm using as in
VT220, VT100, VT102 or the shell... It seems to work in all shells
tried. I would copy and paste what the result of this bug is but it
would just look like normal text. If you want if you can't reproduce
this bug on your own I could provide screenshots. If this is an old bug
let me know. Does anyone know a fix, work around for this?
Thanks,
Ben Allen
ocean () northlink net



begin 666 ATT00044.htm
M/&AT;6P@>&UL;G,Z=CTB=7)N.G-C:&5M87,M;6EC<F]S;V9T+6-O;3IV;6PB
M('AM;&YS.F\](G5R;CIS8VAE;6%S+6UI8W)O<V]F="UC;VTZ;V9F:6-E.F]F
M9FEC92(@>&UL;G,Z=STB=7)N.G-C:&5M87,M;6EC<F]S;V9T+6-O;3IO9F9I
M8V4Z=V]R9"(@>&UL;G,Z<W0Q/2)U<FXZ<V-H96UA<RUM:6-R;W-O9G0M8V]M
M.F]F9FEC93IS;6%R='1A9W,B('AM;&YS/2)H='1P.B\O=W=W+G<S+F]R9R]4
M4B]214,M:'1M;#0P(CX-"@T*/&AE860^#0H\345402!(5%10+45154E6/2)#
M;VYT96YT+51Y<&4B($-/3E1%3E0](G1E>'0O:'1M;#L@8VAA<G-E=#UU<RUA
M<V-I:2(^#0H-"@T*/&UE=&$@;F%M93U0<F]G260@8V]N=&5N=#U7;W)D+D1O
M8W5M96YT/@T*/&UE=&$@;F%M93U'96YE<F%T;W(@8V]N=&5N=#TB36EC<F]S
M;V9T(%=O<F0@,3 B/@T*/&UE=&$@;F%M93U/<FEG:6YA=&]R(&-O;G1E;G0]
M(DUI8W)O<V]F="!7;W)D(#$P(CX-"CQL:6YK(')E;#U&:6QE+4QI<W0@:')E
M9CTB8VED.F9I;&5L:7-T+GAM;$ P,4,Q.#5$."XX,3,V,T,Y,"(^#0H\;SI3
M;6%R=%1A9U1Y<&4@;F%M97-P86-E=7)I/2)U<FXZ<V-H96UA<RUM:6-R;W-O
M9G0M8V]M.F]F9FEC93IS;6%R='1A9W,B#0H@;F%M93TB4&5R<V]N3F%M92(O
M/@T*/"$M+5MI9B!G=&4@;7-O(#E=/CQX;6P^#0H@/&\Z3V9F:6-E1&]C=6UE
M;G13971T:6YG<SX-"B @/&\Z1&].;W1296QY3VY#4U,O/@T*(#PO;SI/9F9I
M8V5$;V-U;65N=%-E='1I;F=S/@T*/"]X;6P^/"%;96YD:69=+2T^/"$M+5MI
M9B!G=&4@;7-O(#E=/CQX;6P^#0H@/'<Z5V]R9$1O8W5M96YT/@T*(" \=SI3
M<&5L;&EN9U-T871E/D-L96%N/"]W.E-P96QL:6YG4W1A=&4^#0H@(#QW.D=R
M86UM87)3=&%T93Y#;&5A;CPO=SI'<F%M;6%R4W1A=&4^#0H@(#QW.D1O8W5M
M96YT2VEN9#Y$;V-U;65N=$5M86EL/"]W.D1O8W5M96YT2VEN9#X-"B @/'<Z
M16YV96QO<&56:7,O/@T*(" \=SI#;VUP871I8FEL:71Y/@T*(" @/'<Z0G)E
M86M7<F%P<&5D5&%B;&5S+SX-"B @(#QW.E-N87!4;T=R:61);D-E;&PO/@T*
M(" @/'<Z5W)A<%1E>'17:71H4'5N8W0O/@T*(" @/'<Z57-E07-I86Y"<F5A
M:U)U;&5S+SX-"B @/"]W.D-O;7!A=&EB:6QI='D^#0H@(#QW.D)R;W=S97),
M979E;#Y-:6-R;W-O9G1);G1E<FYE=$5X<&QO<F5R-#PO=SI"<F]W<V5R3&5V
M96P^#0H@/"]W.E=O<F1$;V-U;65N=#X-"CPO>&UL/CPA6V5N9&EF72TM/CPA
M+2U;:68@(6US;UT^#0H\<W1Y;&4^#0IS=#%<.BI[8F5H879I;W(Z=7)L*"-D
M969A=6QT(VEE;V]U:2D@?0T*/"]S='EL93X-"CPA6V5N9&EF72TM/@T*/'-T
M>6QE/@T*/"$M+0T*("\J(%-T>6QE($1E9FEN:71I;VYS("HO#0H@<"Y-<V].
M;W)M86PL(&QI+DUS;TYO<FUA;"P@9&EV+DUS;TYO<FUA; T*"7MM<V\M<W1Y
M;&4M<&%R96YT.B(B.PT*"6UA<F=I;CHP:6X[#0H);6%R9VEN+6)O='1O;3HN
M,# P,7!T.PT*"6US;RUP86=I;F%T:6]N.G=I9&]W+6]R<&AA;CL-"@EF;VYT
M+7-I>F4Z,3(N,'!T.PT*"69O;G0M9F%M:6QY.B)4:6UE<R!.97<@4F]M86XB
M.PT*"6US;RUF87)E87-T+69O;G0M9F%M:6QY.B)4:6UE<R!.97<@4F]M86XB
M.WT-"F$Z;&EN:RP@<W!A;BY-<V](>7!E<FQI;FL-"@E[8V]L;W(Z8FQU93L-
M"@ET97AT+61E8V]R871I;VXZ=6YD97)L:6YE.PT*"71E>'0M=6YD97)L:6YE
M.G-I;F=L93M]#0IA.G9I<VET960L('-P86XN37-O2'EP97)L:6YK1F]L;&]W
M960-"@E[8V]L;W(Z<'5R<&QE.PT*"71E>'0M9&5C;W)A=&EO;CIU;F1E<FQI
M;F4[#0H)=&5X="UU;F1E<FQI;F4Z<VEN9VQE.WT-"G-P86XN16UA:6Q3='EL
M93$W#0H)>VUS;RUS='EL92UT>7!E.G!E<G-O;F%L+6-O;7!O<V4[#0H);7-O
M+7-T>6QE+6YO<VAO=SIY97,[#0H);7-O+6%N<VDM9F]N="US:7IE.C$P+C!P
M=#L-"@EM<V\M8FED:2UF;VYT+7-I>F4Z,3 N,'!T.PT*"69O;G0M9F%M:6QY
M.D%R:6%L.PT*"6US;RUA<V-I:2UF;VYT+69A;6EL>3I!<FEA;#L-"@EM<V\M
M:&%N<VDM9F]N="UF86UI;'DZ07)I86P[#0H);7-O+6)I9&DM9F]N="UF86UI
M;'DZ07)I86P[#0H)8V]L;W(Z=VEN9&]W=&5X=#M]#0IS<&%N+E-P96QL10T*
M"7MM<V\M<W1Y;&4M;F%M93HB(CL-"@EM<V\M<W!L+64Z>65S.WT-"G-P86XN
M1W)A;44-"@E[;7-O+7-T>6QE+6YA;64Z(B([#0H);7-O+6=R86TM93IY97,[
M?0T*0'!A9V4@4V5C=&EO;C$-"@E[<VEZ93HX+C5I;B Q,2XP:6X[#0H);6%R
M9VEN.C$N,&EN(#$N,C5I;B Q+C!I;B Q+C(U:6X[#0H);7-O+6AE861E<BUM
M87)G:6XZ+C5I;CL-"@EM<V\M9F]O=&5R+6UA<F=I;CHN-6EN.PT*"6US;RUP
M87!E<BUS;W5R8V4Z,#M]#0ID:78N4V5C=&EO;C$-"@E[<&%G93I396-T:6]N
M,3M]#0HM+3X-"CPO<W1Y;&4^#0H\(2TM6VEF(&=T92!M<V\@,3!=/@T*/'-T
M>6QE/@T*("\J(%-T>6QE($1E9FEN:71I;VYS("HO( T*('1A8FQE+DUS;TYO
M<FUA;%1A8FQE#0H)>VUS;RUS='EL92UN86UE.B)486)L92!.;W)M86PB.PT*
M"6US;RUT<W1Y;&4M<F]W8F%N9"US:7IE.C [#0H);7-O+71S='EL92UC;VQB
M86YD+7-I>F4Z,#L-"@EM<V\M<W1Y;&4M;F]S:&]W.GEE<SL-"@EM<V\M<W1Y
M;&4M<&%R96YT.B(B.PT*"6US;RUP861D:6YG+6%L=#HP:6X@-2XT<'0@,&EN
M(#4N-'!T.PT*"6US;RUP87)A+6UA<F=I;CHP:6X[#0H);7-O+7!A<F$M;6%R
M9VEN+6)O='1O;3HN,# P,7!T.PT*"6US;RUP86=I;F%T:6]N.G=I9&]W+6]R
M<&AA;CL-"@EF;VYT+7-I>F4Z,3 N,'!T.PT*"69O;G0M9F%M:6QY.B)4:6UE
M<R!.97<@4F]M86XB.WT-"CPO<W1Y;&4^#0H\(5ME;F1I9ETM+3X-"CPO:&5A
M9#X-"@T*/&)O9'D@;&%N9SU%3BU54R!L:6YK/6)L=64@=FQI;FL]<'5R<&QE
M('-T>6QE/2=T86(M:6YT97)V86PZ+C5I;B<^#0H-"CQD:78@8VQA<W,]4V5C
M=&EO;C$^#0H-"CQP(&-L87-S/4US;TYO<FUA;#X\9F]N="!S:7IE/3,@9F%C
M93TB5&EM97,@3F5W(%)O;6%N(CX\<W!A;B!S='EL93TG9F]N="US:7IE.@T*
M,3(N,'!T)SXH5&AI<R!I<R!A('!O<W0@=&AA="!)('-E;G0@=&\@/'-P86X@
M8VQA<W,]4W!E;&Q%/D)U9U1R87$\+W-P86X^*3QO.G ^/"]O.G ^/"]S<&%N
M/CPO9F]N=#X\+W ^#0H-"CQP(&-L87-S/4US;TYO<FUA;#X\9F]N="!S:7IE
M/3,@9F%C93TB5&EM97,@3F5W(%)O;6%N(CX\<W!A;B!S='EL93TG9F]N="US
M:7IE.@T*,3(N,'!T)SY))B,X,C$W.W9E(&9O=6YD(&$@8G5G+B!))B,X,C$W
M.VT@;F]T('-U<F4@=VAA="!T:&4@8G5G(&ES(&EN+B!3:6YC92!I= T*:7,@
M<V\@=VED96QY(&9O=6YD($D@8V%N)B,X,C$W.W0@9FEN9"!O=70@=VAA="!I
M="!I<RX@/&\Z<#X\+V\Z<#X\+W-P86X^/"]F;VYT/CPO<#X-"@T*/' @8VQA
M<W,]37-O3F]R;6%L/CQF;VYT('-I>F4],R!F86-E/2)4:6UE<R!.97<@4F]M
M86XB/CQS<&%N('-T>6QE/2=F;VYT+7-I>F4Z#0HQ,BXP<'0G/D9O<B!A;B!E
M>&%M<&QE('1E;&YE="!I;G1O(&%N>2!33510('-E<G9E<B!Y;W4@;&EK92!F
M<F]M(&$@/'-P86X-"F-L87-S/5-P96QL13X\<W!A;B!C;&%S<SU'<F%M13YU
M;FEX/"]S<&%N/CPO<W!A;CX@<')O;7!T+B!))B,X,C$W.W9E(&]N;'D-"G1E
M<W1E9"!F<F]M(#QS<&%N(&-L87-S/5-P96QL13Y/<&5N0E-$/"]S<&%N/B S
M+C @0W5R<F5N="X@3F]W(&5N=&5R('1H:7,@:7,Z/&\Z<#X\+V\Z<#X\+W-P
M86X^/"]F;VYT/CPO<#X-"@T*/' @8VQA<W,]37-O3F]R;6%L/CQF;VYT('-I
M>F4],R!F86-E/2)4:6UE<R!.97<@4F]M86XB/CQS<&%N('-T>6QE/2=F;VYT
M+7-I>F4Z#0HQ,BXP<'0G/EY.7DY>3CQO.G ^/"]O.G ^/"]S<&%N/CPO9F]N
M=#X\+W ^#0H-"CQP(&-L87-S/4US;TYO<FUA;#X\9F]N="!S:7IE/3,@9F%C
M93TB5&EM97,@3F5W(%)O;6%N(CX\<W!A;B!S='EL93TG9F]N="US:7IE.@T*
M,3(N,'!T)SXF;'0[4F5T=7)N)F=T.SQO.G ^/"]O.G ^/"]S<&%N/CPO9F]N
M=#X\+W ^#0H-"CQP(&-L87-S/4US;TYO<FUA;#X\9F]N="!S:7IE/3,@9F%C
M93TB5&EM97,@3F5W(%)O;6%N(CX\<W!A;B!S='EL93TG9F]N="US:7IE.@T*
M,3(N,'!T)SY>3CQO.G ^/"]O.G ^/"]S<&%N/CPO9F]N=#X\+W ^#0H-"CQP
M(&-L87-S/4US;TYO<FUA;#X\9F]N="!S:7IE/3,@9F%C93TB5&EM97,@3F5W
M(%)O;6%N(CX\<W!A;B!S='EL93TG9F]N="US:7IE.@T*,3(N,'!T)SXF;'0[
M4F5T=7)N)F=T.SQO.G ^/"]O.G ^/"]S<&%N/CPO9F]N=#X\+W ^#0H-"CQP
M(&-L87-S/4US;TYO<FUA;#X\9F]N="!S:7IE/3,@9F%C93TB5&EM97,@3F5W
M(%)O;6%N(CX\<W!A;B!S='EL93TG9F]N="US:7IE.@T*,3(N,'!T)SY>3CQO
M.G ^/"]O.G ^/"]S<&%N/CPO9F]N=#X\+W ^#0H-"CQP(&-L87-S/4US;TYO
M<FUA;#X\9F]N="!S:7IE/3,@9F%C93TB5&EM97,@3F5W(%)O;6%N(CX\<W!A
M;B!S='EL93TG9F]N="US:7IE.@T*,3(N,'!T)SX\;SIP/B9N8G-P.SPO;SIP
M/CPO<W!A;CX\+V9O;G0^/"]P/@T*#0H\<"!C;&%S<SU-<V].;W)M86P^/&9O
M;G0@<VEZ93TS(&9A8V4](E1I;65S($YE=R!2;VUA;B(^/'-P86X@<W1Y;&4]
M)V9O;G0M<VEZ93H-"C$R+C!P="<^7DX@:7,@97%U:79A;&5N="!T;R!#=')L
M+4XN($EF(&ET(&1O97-N)B,X,C$W.W0@=V]R:R!A9&0@82!F97<@;6]R92!>
M3@T*)FQT.W)E='5R;G,F9W0[(&%T('1H92!E;F0N/&\Z<#X\+V\Z<#X\+W-P
M86X^/"]F;VYT/CPO<#X-"@T*/' @8VQA<W,]37-O3F]R;6%L/CQF;VYT('-I
M>F4],R!F86-E/2)4:6UE<R!.97<@4F]M86XB/CQS<&%N('-T>6QE/2=F;VYT
M+7-I>F4Z#0HQ,BXP<'0G/E1H:7,@=&AE;B!T=7)N<R!A;GD@:6YP=70@86YD
M('-O;64@;W5T<'5T(&EN=&\@<W1R86YG92!C:&%R86-T97)S+B!.;W<-"FEF
M('EO=2!C;W!Y(&%N9"!P87-T92!T:&5S92!S=')A;F=E('-Y;6)O;',@:6YT
M;R!A('=O<F0@<')O8V5S<V]R(&%N9"!I="!W:6QL#0IP87-T92!T:&4@;F]R
M;6%L('1E>'0@:6YT;R!I="X@22!D:60@=&AI<R!W:71H($UI8W)O<V]F="!W
M;W)D(&%N9"!C;W!Y:6YG(&ET#0IF<F]M(#QS<&%N(&-L87-S/5-P96QL13Y3
M96-U<F5#4E0\+W-P86X^+B!.;W<@=&AI<R!I;B!I=',@<V5L9B!I<VXF(S@R
M,3<[="!A#0IR96%L('!R;V)L96T@;W1H97(@=&AE;B!A;B!A;FYO>6%N8V4L
M(&)U="!I9B!Y;W4@:&%D(&$@;&]C86P@;65S<V%G:6YG('1Y<&4-"G!R;V=R
M86T@<V%Y(&-O9&5D(&EN('-H96QL('-C<FEP="!A;F0@:68@:70@<')I;G1E
M9"!T:&4@97AA8W0@;65S<V%G92!B86-K('1O#0IY;W4N($ET(&-O=6QD(&EN
M('1U<FX@<V-R97<@=7 @>6]U<B!A8FEL:71Y('1O('1E;&P@=VAA="!Y;W4@
M=VAE<F4@='EP:6YG+B!)#0IK;F]W(&]F(&$@<')O9W)A;2!C86QL960@<V5N
M9"!M861E(&)Y(&%D;6EN(&]F(&$@9G)E92!S:&5L;"!S97)V97(@=&AA= T*
M228C.#(Q-SMM(&$@;65M8F5R(&]F('1H870@8V%N('!R;V1U8V4@=&AI<R!A
M9F9E8W0N($EF('EO=2!W86YT('-O=7)C92!C;V1E('1O#0IT:&%T('!R;V=R
M86T@<V5N9" \<W!A;B!C;&%S<SU'<F%M13YM93PO<W!A;CX@86X@96UA:6P@
M86YD($DF(S@R,3<[;&P@9V5T('EO=2!A#0IC;W!Y+B!))B,X,C$W.VT@;F]T
M('-U<F4@:68@=&AI<R!I<R!A(&)U9R!I;B!T:&4@96UU;&%T:6]N('1H870@
M228C.#(Q-SMM('5S:6YG#0IA<R!I;B!65#(R,"P@5E0Q,# L(%94,3 R(&]R
M('1H92!S:&5L;"XN+B!)="!S965M<R!T;R!W;W)K(&EN(&%L;"!S:&5L;',@
M=')I960N#0I)('=O=6QD(&-O<'D@86YD('!A<W1E('=H870@=&AE(')E<W5L
M="!O9B!T:&ES(&)U9R!I<R!B=70@:70@=V]U;&0@:G5S="!L;V]K#0IL:6ME
M(&YO<FUA;"!T97AT+B!)9B!Y;W4@=V%N="!I9B!Y;W4@8V%N)B,X,C$W.W0@
M<F5P<F]D=6-E('1H:7,@8G5G(&]N('EO=7(@;W=N#0I)(&-O=6QD('!R;W9I
M9&4@<V-R965N<VAO=',N($EF('1H:7,@:7,@86X@;VQD(&)U9R!L970@;64@
M:VYO=RX@1&]E<R!A;GEO;F4-"FMN;W<@82!F:7@L('=O<FL@87)O=6YD(&9O
M<B!T:&ES/SQO.G ^/"]O.G ^/"]S<&%N/CPO9F]N=#X\+W ^#0H-"CQP(&-L
M87-S/4US;TYO<FUA;#X\9F]N="!S:7IE/3,@9F%C93TB5&EM97,@3F5W(%)O
M;6%N(CX\<W!A;B!S='EL93TG9F]N="US:7IE.@T*,3(N,'!T)SY4:&%N:W,L
M/&\Z<#X\+V\Z<#X\+W-P86X^/"]F;VYT/CPO<#X-"@T*/' @8VQA<W,]37-O
M3F]R;6%L/CQF;VYT('-I>F4],R!F86-E/2)4:6UE<R!.97<@4F]M86XB/CQS
M<&%N('-T>6QE/2=F;VYT+7-I>F4Z#0HQ,BXP<'0G/D)E;B!!;&QE;CQO.G ^
M/"]O.G ^/"]S<&%N/CPO9F]N=#X\+W ^#0H-"CQP(&-L87-S/4US;TYO<FUA
M;#X\<W0Q.E!E<G-O;DYA;64^/&9O;G0@<VEZ93TS(&9A8V4](E1I;65S($YE
M=R!2;VUA;B(^/'-P86X-"B!S='EL93TG9F]N="US:7IE.C$R+C!P="<^;V-E
M86Y ;F]R=&AL:6YK+FYE=#PO<W!A;CX\+V9O;G0^/"]S=#$Z4&5R<V]N3F%M
M93X\;SIP/CPO;SIP/CPO<#X-"@T*/' @8VQA<W,]37-O3F]R;6%L/CQF;VYT
M('-I>F4],B!F86-E/4%R:6%L/CQS<&%N('-T>6QE/2=F;VYT+7-I>F4Z,3 N
M,'!T.PT*9F]N="UF86UI;'DZ07)I86PG/CQO.G ^)FYB<W [/"]O.G ^/"]S
M<&%N/CPO9F]N=#X\+W ^#0H-"CPO9&EV/@T*#0H\+V)O9'D^#0H-"CPO:'1M
$;#X-"@``
`
end