Re: Advisory: sudo 1.8 Format String Vulnerability

[Grandma Eubanks <tborland1 () gmail com>]

The initial release links to the Phrack article with the information on how
to do this. I'm wondering how much they attempted reliability on aslr issue.

On Mon, Feb 6, 2012 at 5:10 AM, Michele Orru <antisnatchor () gmail com> wrote:

> On Mon, Feb 6, 2012 at 11:56 AM, Roman Medina-Heigl Hernandez
> <roman () rs-labs com> wrote:
> > Folks at @vupen seems to have it exploited the hard way.
> >
> > "We successfully exploited the recent Sudo local root / format string
> vuln
> > including full bypass of FORTIFY_SOURCE #GotRoot"
>
> Yep, looks like.
>
> I hope it will not be like with the Chrome Sandbox bypass
> that was achieved through a flash 0day :-)
>
> Maybe this time they exploited sudo through CUPS 1.1 ahah
>
> antisnatchor
>
> > Src:
> > https://twitter.com/#!/VUPEN/status/165454997444767745
> >
> > Cheers,
> > -Román
> >
> > joernchen of Phenoelit escribió:
> > > Hi,
> > >
> > >
> > > On 01/31/2012 05:14 PM, Todd C. Miller wrote:
> > > > joernchen is correct, it is probably still possible to exploit with
> > > > -D_FORTIFY_SOURCE=2, though it is more difficult.  On systems with
> > > > ASLR and a non-executable stack it should be even harder.
> > >
> > > nasty thing is: it's a local exploit so you got nearly unlimited tries
> > > for free =). It will just be noisy in dmesg due to all the segfaults
> > > while brute forcing the right values.
> > >
> > >
> > > cheers,
> > >
> > > joernchen
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
>
>
> --
> /antisnatchor
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/