|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: Buffer overflow in Dovecot or OpenSSL?
From: Timo Sirainen (tss
iki.fi)
Date: Wed Apr 09 2003 - 09:50:11 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On Wed, 2003-04-09 at 15:38, 3APA3A wrote:
> Dear Timo Sirainen,
>
> You're right, the fact EIP points inside the stack should indicate large
> problems. But the string at EIP doesn't look to be shellcode or it's
> part.
Shellcode could have been before or after it, because of stack base
randomization.
> How many entries do you have in the log?
Just one, which I think means that either the attacker tried not to look
suspicious, or just that it was some random bug that triggered the first
time.
> Do you have stackdump?
No, PAX killed it with SIGKILL so I couldn't debug it at all.
I'm anyway pretty sure that this wasn't caused at least directly by my
code. There's very few buffers in stack, and they're all written to with
bounds checking so even corrupted heap shouldn't cause this.
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]