Re: [Full-disclosure] Advisory: sudo 1.8 Format String Vulnerability

The initial release links to the Phrack article with the information on how
to do this. I'm wondering how much they attempted reliability on aslr issue..

On Mon, Feb 6, 2012 at 5:10 AM, Michele Orru <antisnatchor@xxxxxxxxx> wrote:

On Mon, Feb 6, 2012 at 11:56 AM, Roman Medina-Heigl Hernandez
<roman@xxxxxxxxxxx> wrote:
Folks at @vupen seems to have it exploited the hard way.

"We successfully exploited the recent Sudo local root / format string
vuln
including full bypass of FORTIFY_SOURCE #GotRoot"

Yep, looks like.

I hope it will not be like with the Chrome Sandbox bypass
that was achieved through a flash 0day :-)

Maybe this time they exploited sudo through CUPS 1.1 ahah

antisnatchor


Src:
https://twitter.com/#!/VUPEN/status/165454997444767745

Cheers,
-Román

joernchen of Phenoelit escribió:
Hi,


On 01/31/2012 05:14 PM, Todd C. Miller wrote:
joernchen is correct, it is probably still possible to exploit with
-D_FORTIFY_SOURCE=2, though it is more difficult. On systems with
ASLR and a non-executable stack it should be even harder.

nasty thing is: it's a local exploit so you got nearly unlimited tries
for free =). It will just be noisy in dmesg due to all the segfaults
while brute forcing the right values.


cheers,

joernchen

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



--
/antisnatchor

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages