OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: mtr-0.41 root exploit
From: Rogier Wolff (R.E.WolffBITWIZARD.NL)
Date: Tue Apr 25 2000 - 16:41:15 CDT

[Elias, please approve either this one or the previous message that I
sent, but not both. Of course, preferably this one, and not the
other. Thanks. ]

Hi Everyone,

FYI, mtr-0.42 was released on march 4th, which fixes the mtr-oversight
that allows this exploit to work. The actual bug (overflow) is in
the Freebsd libncurses implementation.

Back then we were confident that an exploit COULD be written, but
decided not to wait until one would be written. Point proven.

I would've appreciated the lesser "scare" when an accompanying note
would've said that the bug was already fixed.

                                Roger. 

--
** R.E.WolffBitWizard.nl ** http://www.BitWizard.nl/ ** +31-15-2137555 **
*-- BitWizard writes Linux device drivers for any device you may have! --*
*       Common sense is the collection of                                *
******  prejudices acquired by age eighteen.   -- Albert Einstein ********