From: David Luyer [luyer@UCS.UWA.EDU.AU] Sent: Sunday, August 15, 1999 9:52 PM To: BUGTRAQ@SECURITYFOCUS.COM Subject: Re: Internet Auditing Project The tool mentioned in this has a couple of show-stopper bugs, at least for my system. The options default to -c on, the getopt doesn't accept c and the option parsing just turns it on anyway. Also, the use of longjmp out of an alarm handler breaks things. It should be siglongjump and sigsetjmp. The second alarm signal never happens and the program hangs indefinitely. (this is Linux 2.0.37, glibc 2.1) For those who want to get it working quickly, here's a patch (gzipped, uuencodes, if you don't know how to decode/apply then you shouldn't be using the scanner anyway). begin 644 bass-1.0.7.patch.gz M'XL(""1MMS<"`V)AG;FSL1,2 M/8H=[I']6[SV!B=G4&U4>^X;7#,Z^RL M`OK?F``G7@`A9U/PP&=)2"<9]R1%7R&-B0T'AQ50NP\/(/6X("X$U"?@)0&( M6(_X))N21$+NQ1D1QI?/IE.U):8)42ZJ`+,(_5D62[7S4Y@0B6,+S7U7.YP/?$P0^Q!^@ M:[!J-C56^J6PVALC2@\]`\3"P%<&U3WC5=1\-O-X,)JR@&"(@YM>Q=FR)B17 M'OQIJD+"^#%\ENS;\`L,+BZ@JXVW?3577PTVE=J8)L&F4C/SZZ5F9GQ5&JM(X6>?II"XT1F/$%<32X>GUJ23@G+I-W#RJ"A!>\$D5\1#OP_ MSD(;;"3'*5;H9&71;9AEY3A',%5((^G%#]8](DGDQ6\NT'\SPA]=$/2)L-`R M/VT7+O_XLW_WMPWOWY>@;K3/5^WSN;TQ[RE;E44=AQN92(B<,?ZPB8QR:9V/ M@S.*22V*0!589;J*#-.);$$\Q_"P`7T!X[>[(*VQ%S4+U5Y)^@47TM% M;?IKV_37.?/12,A/BRQ$T0GH]48-B5\1F39%N$/"]"[)A> MVYGWVN\J2A0;+T8CI,5+4\)!1IZ$E!-D=BJPNB:)%P/#%2U5`C\GU"0,+[^< M7]U=@V1*,W9$0@94HM)E7,']-? MGS/E+UE")Y%$_E+B4R\6M5K-W,4V8L)3?Y/8Z.EU+/3DCCBLVBQD_VB!0:>E M,-!/7?>?KR[[-_=PX,=TA_;^NM*8UF,\JO83)U+ZZ'MX&;8'PTO_^D7"\YILD!PE8=M1+S* M1'%[QBU:/]6?$:4,<")2[,H$-51_VX474:&@ZB7;"*JYDS\#X3QAZ*Y_>S>X 6'_1@PK`]A1Z->]@1_@/D5#R88`T````` ` end David.