Re: [xforce () iss net: ISSalert: ISS Advisory: Buffer Overflow in /bin/login]

[wietse () porcupine org (Wietse Venema)]

Dan Stromberg:
> The CERT advisory says this is multiplatform.
>
> Could someone give me the exploit please?  I'd like to test a woraround.

Traditionally SYSV login accepts "username name=value name=value..."
both from the command line and from stdin. It isn't hard to find out
if you can/cannot clobber process memory by specifying a sufficient
number of name=value values.

        Wietse