[6844] in bugtraq
Re: HP-UX finger possible security hole
daemon@ATHENA.MIT.EDU (Walter Misar)
Thu May 28 14:05:10 1998
Date: Wed, 27 May 1998 08:45:22 +0200
Reply-To: Walter Misar <misar@RBG.INFORMATIK.TU-DARMSTADT.DE>
From: Walter Misar <misar@RBG.INFORMATIK.TU-DARMSTADT.DE>
To: BUGTRAQ@NETSPACE.ORG
> while i was playing with the finger command, i got a coredump when
> i submit
>
> finger aaaa ( 200 random caracters )
>
> i wonder if this is a possible security hole because the finger
> command is owned by bin group.
The situation is far worse, if fingerd is run (which invokes finger).
> my HP-UX is A.09.05 A 9000/73
>
> sorry if this is an old bug i didn t had the time to check the archive
> and forgive me for my broken english :)
When I first noticed this some years ago, I didn't find anything about it
in any archives. But the hole should prove hard to exploit anyway - at least
for the m68k hpux version, the overflow was in the malloc() area - it cores
after a second call to malloc(). So standard techniques won't apply, but
it should be possible to direct the write to the second malloced() area to
any memory location.
Walter
