Re: Exploit for buffer overflow in /bin/eject - Solaris 2.X -

[casper () HOLLAND SUN COM (Casper Dik)]

> Thu  Mar 13 21:01:00 EET 1997  - Romania
>
> "Hole in /bin/eject - buffer overflow"
>
> I exploited the buffer overflow hole in /bin/eject on Solaris 2.X (who
> have suid exec bit and is owned by root). The buffer overflow problem
> appears in an internal function media_find(). The result is: any user can
> gain root shell. So, to prevent /bin/eject exploit, you have to get out
> suid-exec bit from /bin/eject (that's very simple) and compile a little
> program like:


This bug is most likely fixed with the following Sun patches:


101907-13: SunOS 5.4: fixes to volume management
101908-13: SunOS 5.4_x86: fixes to volume management
104010-01: SunOS 5.5.1: VolMgt Patch
104011-01: SunOS 5.5.1_x86: VolMgt Patch
104012-01: SunOS 5.5.1_ppc: VolMgt Patch
104015-01: SunOS 5.5: vold filemgr fixes
104016-01: SunOS 5.5_x86: vold filemgr fixes


Casper