[23317] in bugtraq
UUCP
daemon@ATHENA.MIT.EDU (Izik)
Thu Nov 29 17:38:34 2001
Message-ID: <3C062655.3060207@tty64.org>
Date: Thu, 29 Nov 2001 14:13:09 +0200
From: Izik <izik@tty64.org>
MIME-Version: 1.0
To: vuln-dev@security-focus.com, bugtraq@securityfocus.com
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Hello
i've found buffer overflow in uucp. in BSDi platform's
right now i've checked that on:
BSDI BSD/OS 4.0.1 Kernel #1: Thu Jun 10 15:24:57 PDT 1999
BSDI BSD/OS 3.0 Kernel #0: Thu Jan 30 13:02:43 MST 1997
versions that seems to be vuln are:
Version: uucp_args.c,v 2.1 1995/02/03 13:22:07 polk Exp
"BSD/OS 4.0 98/06/11"
Version: uucp_args.c,v 2.1 1995/02/03 13:22:07 polk Exp
"BSD/OS 3.0 97/01/17"
buffer overflow is based on command line argv. for ex:
/usr/bin/uucp `perl -e 'print "A" x 900'` `perl -e 'print "A" x 900'`
`perl -e 'print "A" x 356'`
the ret addr is totaly writable, and it's marked as 352 - 354.
in the thrid buffer (from left to right).
since uucp is by nature suid. and the ownership is by uucp
i don't see the real profit. what does bother me is that uucp
also got a daemon ...
Singed.
izik @ http://www.tty64.org
