Re: UUCPFrom: Iván Arce (firstname.lastname@example.org)
- Previous message: Russell Handorf: "Re: Apache HTTPD's magical behavior"
- In reply to: Izik: "UUCP"
- Next in thread: Enchanter tim: "Re: UUCP"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-ID: <01df01c179e0$3a9f05e0$2e58a8c0@ffornicario> From: Iván Arce <email@example.com> To: <firstname.lastname@example.org> Subject: Re: UUCP Date: Fri, 30 Nov 2001 17:47:30 -0300
dunno if its the same thing, OpenBSD's changelog shows a
security fix for uuxqt parsing of command line arguments
on Sept. 11, 2001:
"Understanding. A cerebral secretion that enables one having it to know a house from a horse by the roof on the house, Its nature and laws have been exhaustively expounded by Locke, who rode a house, and Kant, who lived in a horse." - Ambrose Bierce
----- Original Message ----- From: Izik <email@example.com> Newsgroups: core.lists.exploit-dev To: <firstname.lastname@example.org> Sent: Thursday, November 29, 2001 9:13 AM Subject: UUCP
> Hello > > i've found buffer overflow in uucp. in BSDi platform's > right now i've checked that on: > > BSDI BSD/OS 4.0.1 Kernel #1: Thu Jun 10 15:24:57 PDT 1999 > BSDI BSD/OS 3.0 Kernel #0: Thu Jan 30 13:02:43 MST 1997 > > versions that seems to be vuln are: > > Version: uucp_args.c,v 2.1 1995/02/03 13:22:07 polk Exp > "BSD/OS 4.0 98/06/11" > > Version: uucp_args.c,v 2.1 1995/02/03 13:22:07 polk Exp > "BSD/OS 3.0 97/01/17" > > buffer overflow is based on command line argv. for ex: > > /usr/bin/uucp `perl -e 'print "A" x 900'` `perl -e 'print "A" x 900'` > `perl -e 'print "A" x 356'` > > the ret addr is totaly writable, and it's marked as 352 - 354. > in the thrid buffer (from left to right). > > since uucp is by nature suid. and the ownership is by uucp > i don't see the real profit. what does bother me is that uucp > also got a daemon ... > > Singed. > izik @ http://www.tty64.org >
--- for a personal reply use: =?iso-8859-1?Q?Iv=E1n_Arce?= <email@example.com>