Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Vulnerability Development: samba base64 encode vulnerability

samba base64 encode vulnerability

From: <infamous41md_at_hotpop.com>
Date: Fri, 23 Jul 2004 02:24:39 -0400

a question about exploiting the samba vuln.

    if (*s == '=') n -= 1;

    /* fix up length */
    decoded.length = n;

    memcpy(s, decoded.data, decoded.length);

if n == 0 before it is decremented, then it will wrap around to ~0 and the memcpy will eventually SEGFAULT. but can you exploit it still? 

-- 
-sean-- 
-sean
Received on Jul 24 2004
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos