[20173] in bugtraq
HylaFAX vulnerability
daemon@ATHENA.MIT.EDU (Marcin Dawcewicz)
Thu Apr 12 14:52:44 2001
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-ID: <Pine.LNX.4.21.0104120250580.4724-100000@aph.waw.pdi.net>
Date: Thu, 12 Apr 2001 03:22:20 +0200
Reply-To: Marcin Dawcewicz <miv@IIDEA.PL>
From: Marcin Dawcewicz <miv@IIDEA.PL>
To: BUGTRAQ@SECURITYFOCUS.COM
Hi,
I've found classical format bug while I was playing with HylaFAX
server (v4.1 beta2):
$ [ -u /usr/sbin/hfaxd ] && /usr/sbin/hfaxd -q '%n%n' # SUID uucp
Segmentation fault
It crashes while calling syslog() with user supplied fmt. Looks nasty.
Sorry, I have no working exploit, I won't have one and I have no idea if
there are other similar bugs in HylaFAX. I just taught it will be nice to
bring this case to your attention, guys. Maybe someone, who has more time
than I have can do a little more research.
--
greets,
-= Marcin Dawcewicz =- mailto: miv@gnu.org.pl
"When freedom is outlawed, only outlaws will be free"
