Oh, hell, If you don't remove all UUCP stuff as part of your initial OS install and security lock down in the first place, there are problems.. =) UUCP. LP. Solaris NSCD. NIS. SNMPd. Should all be bye bye before the machine even sees a link light. <IMHO> jamie On Thu, Nov 29, 2001 at 02:13:09PM +0200, Izik wrote: > Hello > > i've found buffer overflow in uucp. in BSDi platform's > right now i've checked that on: > > BSDI BSD/OS 4.0.1 Kernel #1: Thu Jun 10 15:24:57 PDT 1999 > BSDI BSD/OS 3.0 Kernel #0: Thu Jan 30 13:02:43 MST 1997 > > versions that seems to be vuln are: > > Version: uucp_args.c,v 2.1 1995/02/03 13:22:07 polk Exp > "BSD/OS 4.0 98/06/11" > > Version: uucp_args.c,v 2.1 1995/02/03 13:22:07 polk Exp > "BSD/OS 3.0 97/01/17" > > buffer overflow is based on command line argv. for ex: > > /usr/bin/uucp `perl -e 'print "A" x 900'` `perl -e 'print "A" x 900'` > `perl -e 'print "A" x 356'` > > the ret addr is totaly writable, and it's marked as 352 - 354. > in the thrid buffer (from left to right). > > since uucp is by nature suid. and the ownership is by uucp > i don't see the real profit. what does bother me is that uucp > also got a daemon ... > > Singed. > izik @ http://www.tty64.org -- jamie rishaw <jamieat_private> sr. wan/unix engineer/ninja // playboy enterprises inc. [opinions stated are mine, and are not necessarily those of the bunny] "UNIX was not designed to stop people from doing stupid things, because that would also stop them from doing clever things." -- Doug Gwyn
This archive was generated by hypermail 2b30 : Fri Nov 30 2001 - 11:54:35 PST