Re: Buffer overflow in Dovecot or OpenSSL?

From: 3APA3A (3APA3Aat_private)
Date: Wed Apr 09 2003 - 05:38:15 PDT

Next message: Timo Sirainen: "Re: Buffer overflow in Dovecot or OpenSSL?"

Previous message: Admin: "Re: Buffer overflow in Dovecot or OpenSSL?"
In reply to: Timo Sirainen: "Buffer overflow in Dovecot or OpenSSL?"
Next in thread: Timo Sirainen: "Re: Buffer overflow in Dovecot or OpenSSL?"
Reply: Timo Sirainen: "Re: Buffer overflow in Dovecot or OpenSSL?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Dear Timo Sirainen,

You're right, the fact EIP points inside the stack should indicate large
problems.  But  the  string  at EIP doesn't look to be shellcode or it's
part. How many entries do you have in the log? Do you have stackdump?

--Tuesday, April 8, 2003, 11:39:23 PM, you wrote to vuln-devat_private:

TS> I saw a disturbing message today:

TS> PAX: terminating task: /usr/local/libexec/dovecot/imap-login(imap-login):13964, uid/euid: 102/102, EIP: 5D0CB8B8, ESP: 5D0CB82C
TS> PAX: bytes at EIP: d8 b8 0c 5d 25 14 05 08 f8 9e 06 08 01 00 00 00 20 ca 04 08 


-- 
~/ZARAZA
Впрочем, важнее всего - алгоритм!  (Лем)

Next message: Timo Sirainen: "Re: Buffer overflow in Dovecot or OpenSSL?"
Previous message: Admin: "Re: Buffer overflow in Dovecot or OpenSSL?"
In reply to: Timo Sirainen: "Buffer overflow in Dovecot or OpenSSL?"
Next in thread: Timo Sirainen: "Re: Buffer overflow in Dovecot or OpenSSL?"
Reply: Timo Sirainen: "Re: Buffer overflow in Dovecot or OpenSSL?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Apr 09 2003 - 08:06:15 PDT