Re: Very interesting traceroute flaw

[Casper Dik <Casper.Dik () HOLLAND SUN COM>]

> I'm starting with a credit section because I did not discover this
> flaw. The flaw was discovered by Pekka Savola <pekkas () netcore fi>, who
> noted that traceroute could be caused to crash, which is pretty suboptimal
> behaviour for a suid-root program :-) I took this forward and speculate
> that in fact this very minor code flaw may well be exploitable.


Even though Solaris 7 and later include LBNL traceroute, the first
version of the source checked into SCCS has the following interesting
comment (this branch dates from 98/01/12):

                /*
                 * LBNL bug fixed: used to call savestr(), which was buggy
                 * it gives bus error when more than one -g used
                 * savestr.h removed
                 */

The code was completely removed when IPv6 support was integrated much
later.



Casper