[34694] in bugtraq
Re: Squirrelmail Chpasswod bof
daemon@ATHENA.MIT.EDU (p dont think)
Tue Apr 27 22:14:54 2004
Message-ID: <408DA73D.30501@angrynerds.com>
Date: Mon, 26 Apr 2004 17:20:13 -0700
From: p dont think <pdontthink@angrynerds.com>
MIME-Version: 1.0
To: bugtraq@securityfocus.com
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
All,
Replying to this thread using the web interface didn't seem to work
at all, so... Please excuse me effectively starting the thread over,
but wanted to make sure a follow-up got posted to the list. See:
http://www.securityfocus.com/archive/1/360547/2004-04-14/2004-04-20/2
> Hi all
>
> There is a boffer over flow in the chpasswd binary, distributed with
> the plugin. This allow to local's user to execute commands as a root.
This problem (and several others that were really needing to be
fixed) has been resolved and a new version of this plugin is available
at the link below. Obviously, it is highly recommended that anyone
using this plugin upgrade immediately.
http://www.squirrelmail.org/plugin_view.php?id=117
Matias, next time please contact the plugin authors, any of the
SquirrelMail mailing lists, SquirrelMail IRC, or other SquirrelMail
developers before posting.
Thanks,
Paul
> ---:::Prott:::---
> root@orco:/mnt/hosting/hack/bof# su webmaster
> webmaster@orco:/mnt/hosting/hack/bof$ ./exploit 166 5555 99999
> Using address: 0xbfffe325
> bash-2.05b$ ./chpasswd $RET asdf asdf
> The new password is equal to old password. Choose another password.
> sh-2.05b# id
> uid=0(root) gid=3(sys) groups=500(webmaster)
> sh-2.05b#
> ---:::end:::---
>
> Bye all
