[12834] in bugtraq
Re: Security Advisory: Buffer overflow in RSAREF2
daemon@ATHENA.MIT.EDU (Gerardo Richarte)
Fri Dec 3 13:40:13 1999
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <3846CC26.513CE96F@core-sdi.com>
Date: Thu, 2 Dec 1999 16:50:46 -0300
Reply-To: Gerardo Richarte <core.lists.bugtraq@CORE-SDI.COM>
From: Gerardo Richarte <core.lists.bugtraq@CORE-SDI.COM>
X-To: BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Gerardo Richarte wrote:
>
> While researching the exploitability of a buffer overflow in
> SSH up to version 1.2.27, we discovered a second buffer overflow
> in the implmementation of the RSA algorithm in RSAREF2 from
> RSA Data Security.
To make this clear: in combination with the buffer overflow in rsaglue.c this makes possible to get
a remote shell on a machine running sshd AND it also makes possible to use a reverse exploit to gain access on
clients' machines, using malicious sshd.
richie
PS: We are studding the possibility of using this buffer overflow alone, not in combination with rsaglue.c. What will make it possible to exploit it on patched ssh and sshd, and probably in OpenSSH
--
A390 1BBA 2C58 D679 5A71 - 86F9 404F 4B53 3944 C2D0
Investigacion y Desarrollo - CoreLabs - Core SDI
http://www.core-sdi.com
--- For a personal reply use gera@core-sdi.com
