mailing list archives
Re: ntpd stack evasion 0day exploit
From: Graham Bignell <bignell () gmail com>
Date: Wed, 11 Jan 2006 10:01:52 -0500
On 11/01/06, Siegfried <siegfri3d () gmail com> wrote:
omfg i hope it isn't marcos flavio who invented that shit again (100%
old-modified exploit & fake site)
or get a fucking brain man!
Not only is this plagiarism of work from five years ago, it was patched
five years ago. Already disclosed, already remedied. No mayhem.
--- ntp_control.c.1 Thu Apr 5 21:41:56 2001
+++ ntp_control.c Thu Apr 5 21:43:02 2001
@@ -1824,6 +1824,8 @@
while (cp < reqend && *cp !=
*tp++ = *cp++;
+ if (tp >= buf + sizeof(buf))
+ return (0);
if (cp < reqend)
*tp = '\0';
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/