Re: Remote exploitation of network scanners?

["Cashdollar, Larry" <lwc () VAPID DHS ORG>]

On Fri, 25 Aug 2000, Lincoln Yeoh wrote:

> Hypothetical scenario:
> A scanner requiring remote input scans a targeted host, looking for replies.
> The targeted host replies with exceptional input causing the scanner to run
> arbitrary code (buffer overflow etc etc), probably with the privileges of
> the user running that scanner.


Scanners utitlizing raw sockets for stuff like OS fingerprinting need to
be run as root.  Some scanners like nessus (last I knew) required a
seperate server running that the scanning client connected too.

I would hope that the server daemon be audited for overflows, format bugs
etc. Everyone makes mistakes, the L0pht has been finding vulnerabilies for
years and yet one was found in Antisniff.


-- Larry