TracerouteNG - never ending story

Hi everyone, I want to provide some additional information about the recently discovered traceroute-ng flaw. I decided to disclose to details right now because I do not believe that the flaw is easily exploitable. 1 The vulnerablilty. The patch provided by vendors like SuSE is not sufficient. It...

Buffer-overflow vulnerability in Midnight Commander

Overview The mcedit component of some versions of Midnight Commander contains a buffer-overflow vulnerability. Description Midnight Commander is a file manager for open source operating systems, distributed under the GNU General Public License GPL. In version 4.5.1 of Midnight Commander, the mced...

New advisory + exploit from LByte

+- Limpid Byte Advisory 003---------------------------------+ | | | Program: 2fax | | Version: all =2.02 | | OS: Linux/Windows | | Bug: Buffer Overflow in -bpcx option | | Homepage: http://www.atbas.org | | | | Discovered by Crazy Einstein [email protected] | | |...

How to reproduce OpenSSH Overflow.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The R7 team did a little investigating into one of the OpenSSH vulnerabilities. The following are instructions on how to reproduce a segmentation violation in sshd v3.2.3p1: 0. Compile with PAM and S/KEY support. 1. Apply the following patch to the ss...

Another flaw in Apache?

Hello. While playing with the SetEnv directive with Apache, I noticed that httpd processes are dying with a signal 11 if the data stored in an environment variable was too long. I simply triggered the bug by creating a .htaccess file so a regular user can do it with : SetEnv DATELOCALE "..." The...

solaris 9 sparc rcp

hallo, freshly installed solaris 9 sparc. one more suid segfault: bash-2.05$ uname -a SunOS solaris9 5.9 Generic sun4u sparc SUNW,Ultra-510 bash-2.05$ ls -l /usr/sbin/static/rcp -r-sr-xr-x 1 root bin 787700 Apr 6 16:58 /usr/sbin/static/rcp bash-2.05$ /usr/sbin/static/rcp perl -e 'print "A" x 1000...

procmail heap overflow

hi, i found a heap overflow in procmail up until latest some time ago. flatline@intra:/usr/bin$ ls -la procmail -rwsr-xr-x 1 root mail 64344 Jun 3 2001 procmail flatline@intra:/usr/bin$ ./procmail perl -e 'print "A"x10240'=A procmail: Exceeded LINEBUF Segmentation fault flatline@intra:/usr/bin$ a...

Interbase 6.0 malloc() issues

====================================================================== Strategic Reconnaissance Team Security Advisory SRT2002-06-17-1043 Topic : Interbase 6.0-1 Date : June 17, 2002 Credit : KF dotslashatsnosoft.com Site : http://www.snosoft.com...

ISS X-Force response

This vulnerability was originally detected auditing the Apache 2.0 source tree. Apache 2.0 uses the same function to determine the chunk size, and has the same vulnerable signed comparison. It is, however, not vulnerable by luck? due to a signed comparison deep within the buffered reading routine...

TRU64 /bin/chsh overflow

oops forgot one ... more soon. = /bin/chsh perl -e 'print "A" x 9000' Segmentation fault uname -a OSF1 alpha.snosoft.com V5.1 732 alpha ls -al /bin/chsh -rws--x--x 3 root bin 32944 Aug 24 2000 /bin/chsh dbx ./chsh core dbx version 5.1 Type 'help' for help. Core file created by program "chsh"...

Sar -o exploitation process info.

Caldera recently released an update for the suid sar binary. At one point in time someone pointed out that sar -f had an overflow Brok Tellier or k2 probably I can't remember. The -f overflow was fixed but the -o option which I have seen in private security advisorys floating around also had an...

Happy Easter / April Fools from Snosoft (Oracle 8.1.5 tnslsnr)

This is ment to be an April fools joke but if you still use old Oracle its not to funny I guess: After I ate a few too many hard boiled eggs this weekend I decided to install Oracle and play with it a little. Being poor I didn't have 800 bones to shell out on Oracle 16i so I had to settle with...

Progress Software suid overflows again.

Yet another b0f in progress software due to pstcopy Progress Software corp. http://www.progress.com STILL can't seem to validate user input... this is in their latest patch level for Progress 9.1C 91C09.tar.Z root@localhost bin cat ../version echo PROGRESS PATCH Version 9.1C09 as of February 26,...

compress(vul) + ftpd(?)

hyph@port $ rpm -qf which compress ncompress-4.2.4-21 hyph@port $ compress perl -e 'print "A" x 1100' AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...

Censoft TERM Emu bOf

Vendor: www.censoft.com Product: TERM for UNIX / Linux Emulations Wyse 60, SCO ANSI, VT220 Terminal Supports SCO, AIX, HP, DEC, Solaris Operating Environmenttm software, and Linuxtm I WAS going to purchase this product after trying the eval however I changed my mind for some reason...I would...

Re: slocate bug.

Heres the details on Mandrake Linux elguapo@linux elguapo$ ls -al which slocate -rwxr-sr-x 2 root slocate 24956 Apr 6 2001 /usr/bin/slocate elguapo@linux elguapo$ uname -a Linux linux.ckfr.com 2.4.3-20mdk 1 Sun Apr 15 23:03:10 CEST 2001 i686 unknown elguapo@linux elguapo$ cat /etc/redhat-release...

slocate bug.

Hey, Its a good time to announce that 2xs security LTD. decided to create a research team in order to focus on finding new bugs, further more we managed to develop a security tool to discover bugs/security flaws. In the near future, the tool itself will became an open source project. slocate Secu...

dnrd 2.10 dos

Program: dnrd Version: 2.10 Distro: n/a Problem: There are various problems with dnrd's dns request and reply functions, that cause it to crash. Reproduce: Using two consoles, I did the following Terminal one got: andrewg@blackhole /data/audit/dnrd-2.10/src$ gdb dnrd GNU gdb 5.0rh-5 Red Hat Linux...

'/usr/bin/at 31337 + vuln' problem + exploit

Affects: /usr/bin/at To check if you are potentially vulnerable to this exploit, execute: /usr/bin/at 31337 + vuln If you are vulnerable this will cause: Segmentation fault If not, there will be a message similar to: Garbled time possibly with some extra information The problem is caused by a bug...

Clanlib overflow / Super Methane Brothers overflow

Charles stayed up all night and found a hole in Eterm so I felt obligated to stay up all night and find something else wrong on my box too. In doing so I found an overflow in a game included with Mandrake 8.1 called Super Methane Brothers. $HOME=bof here then run /usr/games/methane. Inturn that...