Re: Remote exploitation of network scanners?

[Domenico De Vitto <dom () DEVITTO DEMON CO UK>]

Bluefish,
Snoop is basically Sun's home-grown 'tcpdump', and though you can always
sandbox (and hope they can't bust your chroot!), very few (e.g. none) people
are going to expect a vendor supplied 'listen-only' tool to give bad guys
remte root, so....

Dom
-----Original Message-----
From: Bluefish (P.Magnusson) [mailto:11a () gmx net]
Sent: 31 August 2000 12:37
To: Domenico De Vitto
Cc: VULN-DEV () SECURITYFOCUS COM
Subject: Re: Remote exploitation of network scanners?

I'm not overly familiar with this "Snoop" or any other of these scanners,
but....

Can't they be placed inside some kind of home-made containment (sandbox,
or what ever word you prefere). Such as chrooting, dropping capability to
chroot and so on. [would be better if the developers themselves adding
this to their scanners, but until then]

> Snoop RPC buffer overflow.
> Very amusing, especially if you use snoop 24x7 as a kinda homegrown IDS
;-)
> Dom
> PS. Oh, and yes, it's a remote root thang.

..:::::::::::::::::::::::::::::::::::::::::::::::::..
     http://www.11a.nu || http://bluefish.11a.nu
    eleventh alliance development & security team