OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 1st quarter (Jan-Mar) 1995: bsd in.talkd+antiflash remote-remote hole

bsd in.talkd+antiflash remote-remote hole

Julian Assange (proffsuburbia.apana.org.au)
Sat, 11 Mar 1995 02:00:47 +1100 

line ~160 process.c

          if (hp != (struct hostent *)0) {
             char sys_buf[150];
             int child;
             caller_host=hp->h_name;
/*
             SECURITY BUG - Proff
             sprintf(sys_buf,"/etc/flash.mail %s",caller_host);
             system(sys_buf);
*/
          }
          else
            caller_host="unknown";

Modify your DNS hostfield to :

	;any_command_you_want

Set a talk flash to the site running the in.talkd d, and guess what happens?

Cheers,
	Julian Assange -Proff-