OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 3rd quarter (Jul-Aug) 1995: load.root (loadmodule hole)

load.root (loadmodule hole)

der Mouse (mouseCollatz.McRCIM.McGill.EDU)
Fri, 15 Sep 1995 06:54:45 -0400 

For anyone wondering what the loadmodule hole is, but not wanting to
grab the 8lgm exploit and try to grok it, the real secret is very
simple - and I can't understand why 8lgm didn't explain this in their
posting, rather than only in a comment in the exploit script.

The comment in question is:

> # loadmodule has previously been fixed to clear IFS, apparently by
> # putenv("IFS= ").  However, we can still exploit system() by
> # having IFS defined twice in our environment.

                                        der Mouse

                            mousecollatz.mcrcim.mcgill.edu