SuSE posted a UUCP bug a while back just not sure if it is the same one but the advisory stated that anyone using UUCP should upgrade.! -----Original Message----- From: Izik [mailto:izikat_private] Sent: Thursday, November 29, 2001 3:13 PM To: vuln-dev@security-focus.com; bugtraqat_private Subject: UUCP Hello i've found buffer overflow in uucp. in BSDi platform's right now i've checked that on: BSDI BSD/OS 4.0.1 Kernel #1: Thu Jun 10 15:24:57 PDT 1999 BSDI BSD/OS 3.0 Kernel #0: Thu Jan 30 13:02:43 MST 1997 versions that seems to be vuln are: Version: uucp_args.c,v 2.1 1995/02/03 13:22:07 polk Exp "BSD/OS 4.0 98/06/11" Version: uucp_args.c,v 2.1 1995/02/03 13:22:07 polk Exp "BSD/OS 3.0 97/01/17" buffer overflow is based on command line argv. for ex: /usr/bin/uucp `perl -e 'print "A" x 900'` `perl -e 'print "A" x 900'` `perl -e 'print "A" x 356'` the ret addr is totaly writable, and it's marked as 352 - 354. in the thrid buffer (from left to right). since uucp is by nature suid. and the ownership is by uucp i don't see the real profit. what does bother me is that uucp also got a daemon ... Singed. izik @ http://www.tty64.org
This archive was generated by hypermail 2b30 : Fri Nov 30 2001 - 08:58:34 PST