RE: UUCP

["David Hawley" <chiman () hawaiian net>]

This is really funny if true, I remember seeing this bug over a long period
of time, on
many releases of one flavor of UNIX....  wish we would fix it for once and
for all.


                                           David Hawley
                        UNIX & NT Network Security, LLC.
                                drh () 123netsecurity com
                                www.123netsecurity.com



-----Original Message-----
From: Ziggy [mailto:ziggy () sanyutel com]
Sent: Thursday, November 29, 2001 11:18 PM
To: Izik; vuln-dev () security-focus com; bugtraq () securityfocus com
Subject: RE: UUCP


SuSE posted a UUCP bug a while back just not sure if it is the same one but
the advisory stated that anyone using UUCP should upgrade.!


-----Original Message-----
From: Izik [mailto:izik () tty64 org]
Sent: Thursday, November 29, 2001 3:13 PM
To: vuln-dev () security-focus com; bugtraq () securityfocus com
Subject: UUCP


Hello

i've found buffer overflow in uucp. in BSDi platform's
right now i've checked that on:

BSDI BSD/OS 4.0.1 Kernel #1: Thu Jun 10 15:24:57 PDT 1999
BSDI BSD/OS 3.0 Kernel #0: Thu Jan 30 13:02:43 MST 1997

versions that seems to be vuln are:

Version: uucp_args.c,v 2.1 1995/02/03 13:22:07 polk Exp
"BSD/OS 4.0 98/06/11"

Version: uucp_args.c,v 2.1 1995/02/03 13:22:07 polk Exp
"BSD/OS 3.0 97/01/17"

buffer overflow is based on command line argv. for ex:

/usr/bin/uucp `perl -e 'print "A" x 900'` `perl -e 'print "A" x 900'`
`perl -e 'print "A" x 356'`

the ret addr is totaly writable, and it's marked as 352 - 354.
in the thrid buffer (from left to right).

since uucp is by nature suid. and the ownership is by uucp
i don't see the real profit. what does bother me is that uucp
also got a daemon ...

Singed.
izik @ http://www.tty64.org