OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Izik (iziktty64.org)
Date: Thu Nov 29 2001 - 06:13:09 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Hello

    i've found buffer overflow in uucp. in BSDi platform's
    right now i've checked that on:

    BSDI BSD/OS 4.0.1 Kernel #1: Thu Jun 10 15:24:57 PDT 1999
    BSDI BSD/OS 3.0 Kernel #0: Thu Jan 30 13:02:43 MST 1997

    versions that seems to be vuln are:

    Version: uucp_args.c,v 2.1 1995/02/03 13:22:07 polk Exp
    "BSD/OS 4.0 98/06/11"

    Version: uucp_args.c,v 2.1 1995/02/03 13:22:07 polk Exp
    "BSD/OS 3.0 97/01/17"

    buffer overflow is based on command line argv. for ex:

    /usr/bin/uucp `perl -e 'print "A" x 900'` `perl -e 'print "A" x 900'`
    `perl -e 'print "A" x 356'`

    the ret addr is totaly writable, and it's marked as 352 - 354.
    in the thrid buffer (from left to right).

    since uucp is by nature suid. and the ownership is by uucp
    i don't see the real profit. what does bother me is that uucp
    also got a daemon ...

    Singed.
    izik http://www.tty64.org