Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: [ Hackerslab bug_paper ] Linux dump buffer overflow
From: lamagra () HACKERMAIL NET (Lamagra Argamal)
Date: Fri, 3 Mar 2000 19:53:41 -0000


i checked RedHat's 5.2 dump (dump-0.3) and it doesn't seem vunerable in an exploitable way.
There's a minor heap-overflow though:

snipped from optr.c

msg(const char *fmt, ...)
{
        .......
        va_start(ap, fmt);
#else
        va_start(ap);
#endif
        (void) vfprintf(stderr, fmt, ap);
        (void) fflush(stdout);
        (void) fflush(stderr);
        (void) vsprintf(lastmsg, fmt, ap);
        va_end(ap);
        ......
}

Lastmsg is a global variable size = 100

-lamagra
http://lamagra.seKure.de
http://www.b0f.com

Send someone a cool Dynamitemail flashcard greeting!! And get rewarded.
GO AHEAD! http://cards.dynamitemail.com/index.php3?rid=fc-41


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]