Vulnerability Development mailing list archives
Re: Getting passwords from the heap?
From: Felix von Leitner <leitner () vim org>
Date: Tue, 26 Jun 2001 18:55:34 +0200
Thus spake Jason Spence (thalakan () lightconsulting com):
I was trying to explain to someone why it's important to do a memset(3) on newly allocated memory by firing up gdb and doing hexdumps of raw uninitialized memory, when I noticed there was what looked like privileged information in the hexdump!
Your operating system is broken, then.
I don't know very much about the specifics of how malloc works, but is this a valid method of trying to get privileged information from an unprivilieged account? For example, does memory that root allocates then deallocates become available to user processes via malloc(3)?
Both anonymous mmap and brk (the Unix methods for implementing malloc) are specified to return zero-filled pages.
I'm going to research this some more and put together a report with the feedback I get if it turns out that this is a valid method of attacking a system from a non-root account.
This wasn't perchance a Microsoft operating system you were using? Felix
Current thread:
- Getting passwords from the heap? Jason Spence (Jun 26)
- Re: Getting passwords from the heap? Felix von Leitner (Jun 26)
- Re: Getting passwords from the heap? Dennis McHenry (Jun 27)
- Re: Getting passwords from the heap? Jason R. Seats (Jun 27)
- RE: Getting passwords from the heap? Vladimir Kraljevic (Jun 27)
- Re: Getting passwords from the heap? Dennis McHenry (Jun 27)
- Re: Getting passwords from the heap? H D Moore (Jun 26)
- Re: Getting passwords from the heap? Jason Spence (Jun 27)
- Re: Getting passwords from the heap? H D Moore (Jun 27)
- Re: Getting passwords from the heap? Aigars Grins (Jun 27)
- Re: Getting passwords from the heap? Jason Spence (Jun 27)
- Re: Getting passwords from the heap? ian (Jun 28)
- Re: Getting passwords from the heap? Jason Spence (Jun 27)
- Re: Getting passwords from the heap? Felix von Leitner (Jun 26)
- Source code of the Sadmin Worm Cabezon Aurélien [iSecureLabs] (Jun 27)