Re: [ Hackerslab bug_paper ] Linux dump buffer overflow

[lamagra () HACKERMAIL NET (Lamagra Argamal)]

i checked RedHat's 5.2 dump (dump-0.3) and it doesn't seem vunerable in an exploitable way.
There's a minor heap-overflow though:

snipped from optr.c

msg(const char *fmt, ...)
{
        .......
        va_start(ap, fmt);
#else
        va_start(ap);
#endif
        (void) vfprintf(stderr, fmt, ap);
        (void) fflush(stdout);
        (void) fflush(stderr);
        (void) vsprintf(lastmsg, fmt, ap);
        va_end(ap);
        ......
}

Lastmsg is a global variable size = 100

-lamagra
http://lamagra.seKure.de
http://www.b0f.com

Send someone a cool Dynamitemail flashcard greeting!! And get rewarded.
GO AHEAD! http://cards.dynamitemail.com/index.php3?rid=fc-41