mailing list archives
Re: [Full-disclosure] Breaking the links: Exploiting the linker
From: Tim Brown <timb () nth-dimension org uk>
Date: Sun, 16 Oct 2011 19:16:24 +0100
CVEs have now been assigned to the two previously reported bugs as follows:
1) http://www.nth-dimension.org.uk/downloads.php?id=83 - Privesc attack
using DB2 from normal user to root, the PoC is for Linux but based on
testing the AIX version looks iffy too although I couldn't get gcc to
generate a valid library to exploit it.
CVE-2011-4061. FWIW I now have a version of the exploit for this working on
AIX, based on a copy of kbbacf1 from IBM Tivoli Monitoring 220.127.116.11. It
therefore appears that the vulnerable version of kbbacf1 isn't just shipped
2) http://www.nth-dimension.org.uk/downloads.php?id=80 - Generic attack on
the QNX runtime linker which abuses an arbitrary file overwrite and race
condition to get root.
<mailto:timb () nth-dimension org uk>
Description: This is a digitally signed message part.
- Re: [Full-disclosure] Breaking the links: Exploiting the linker Tim Brown (Oct 17)