Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: More ssh fun (sshd this time)
From: wietse () WZV WIN TUE NL (Wietse Venema)
Date: Mon, 25 Aug 1997 18:48:33 -0400


[Reposted. The previous copy disappeared after being forwarded by
the listserv -- Wietse]

Ivo van der Wijk:
- This could also be considered a bug in bind(), because it doesn't wrap
  portnumbers > 65536, but still, it makes sshd vurnerable, at least on Linux
  (2.0.29), Solaris 2.4 and SunOs 4.1.4

Actually, the port number passed to bind() is a 16-bit quantity
(the sin_port member of a struct sockaddr_in).

The fix would be to compare nthos(foo.sin_port) with IPPORT_RESERVED.
By sheer dumb luck, this is exactly what I did in my hacked FTP daemon.

        Wietse



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]