Re: Wu-ftpd FTP server contains remotely exploitable off-by-one bug
From: Kris Kennaway (kris_at_obsecurity.org)
Date: 07/31/03
- Previous message: polytarp_at_cyberspace.org: "Re: Wu-ftpd FTP server contains remotely exploitable off-by-one bug"
- In reply to: polytarp_at_cyberspace.org: "Re: Wu-ftpd FTP server contains remotely exploitable off-by-one bug"
- Next in thread: fbsd_at_w88trigger.com: "Re: Wu-ftpd FTP server contains remotely exploitable off-by-one bug"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 31 Jul 2003 14:37:34 -0700 To: polytarp@cyberspace.org
On Thu, Jul 31, 2003 at 05:31:46PM -0400, polytarp@cyberspace.org wrote:
> On Thu, 31 Jul 2003 mike@sentex.net wrote:
>
> > At 02:40 PM 31/07/2003 -0400, polytarp@cyberspace.org wrote:
> >
> >
> > >Buffer overflows which work on Linux do not work on FreeBSD.
> >
> >
> > You need to qualify that statement. Yes, there are some that will not be
> > relevant and the exact same exploit code will not work. But "Buffer
> > overflows which work on Linux do not work on FreeBSD" is dangerously
> > misleading.... In the case of wu-ftpd there have been several issues in the
> > past that affected both FreeBSD and Linux. Same bug, different exploit
> > code, both vulnerable. That being said, I havent had a chance to review
> > this one so I dont know.
> >
>
> No, you're wrong. Even a different COMPILER -- let alone a different
> OPERATING SYSTEM -- can make buffer overflows not work.
1) Can != will. In most cases these vulnerabilities are fairly
OS-neutral.
2) It is true that a given exploit for the overflowable buffer will
not usually work on a different OS, but that doesn't mean that one
cannot be easily developed to exploit that OS.
Kris
- application/pgp-signature attachment: stored
- Previous message: polytarp_at_cyberspace.org: "Re: Wu-ftpd FTP server contains remotely exploitable off-by-one bug"
- In reply to: polytarp_at_cyberspace.org: "Re: Wu-ftpd FTP server contains remotely exploitable off-by-one bug"
- Next in thread: fbsd_at_w88trigger.com: "Re: Wu-ftpd FTP server contains remotely exploitable off-by-one bug"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
