Bugtraq mailing list archives
Re: Buffer Overflow in ActivePerl ?
From: <noderat () hotmail com>
Date: 19 May 2004 04:10:49 -0000
In-Reply-To: <40AAB885.10935.31071242@localhost>
Looks like full control of EIP... However, there is not likely to be a privilege escalation here unless perhaps a script processor on a web server can be cajoled into doing something with this?? (Not at all familiar with the innards of Windows web servers and their relationship to their CGI, etc processors...) -- Nick FitzGerald Computer Virus Consulting Ltd. Ph/FAX: +64 3 3529854
Unethical intruders don't always require "privilege escalation", executing code on another system is enough, depending on the goal. Networks where say developers are sharing source tree's and the like, placing a hostile piece of code in the central store will allow remote code execution on the developer nodes. Other registers other than EIP can be written, depending on the version, however we need not rely on EIP to allow for a buffer overflow exploit, we don't "need" to overwrite any register in fact to execute code, only to cause a buffer overflow >;] cheers
Current thread:
- Buffer Overflow in ActivePerl ? Oliver () greyhat de (May 17)
- Re: Buffer Overflow in ActivePerl ? rich . sf (May 18)
- RE: [Full-Disclosure] Re: Buffer Overflow in ActivePerl ? Bill Royds (May 18)
- Re: Buffer Overflow in ActivePerl ? Josh Tolley (May 18)
- Re: Buffer Overflow in ActivePerl? Axel Beckert (May 18)
- Re: Buffer Overflow in ActivePerl ? Nick FitzGerald (May 18)
- <Possible follow-ups>
- Re: Buffer Overflow in ActivePerl ? noderat (May 18)
- RE: Buffer Overflow in ActivePerl ? Drew Copley (May 18)
- Re: Buffer Overflow in ActivePerl ? David Cantrell (May 19)
- Re: Buffer Overflow in ActivePerl ? David Ahmad (May 19)
- Re: Buffer Overflow in ActivePerl ? David Cantrell (May 19)
- Re: Buffer Overflow in ActivePerl ? rich . sf (May 18)