Full Disclosure mailing list archives
Re: openssh remote exploit
From: Adam Dyga <adeon () tlen pl>
Date: Wed, 17 Sep 2003 12:20:45 +0200
There is also one little bug in the code, look below. | | void * | buffer_append_space(Buffer *buffer, u_int len) | { | void *p; | | if (len > 0x100000) | fatal("buffer_append_space: len %u not supported", len); | | /* If the buffer is empty, start using it from the beginning. | */ | if (buffer->offset == buffer->end) { | buffer->offset = 0; | buffer->end = 0; | } | restart: | /* If there is enough space to store all data, store it now. | */ | if (buffer->end + len < buffer->alloc) { [...] The comparision should be if (buffer->end + len <= buffer->alloc) { because buffer->end is not an offset of last byte in buffer, but it's an offset of first byte _afer_ the last byte in buffer. Anyway, this is not a security flaw. -- Greets adeon _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- openssh remote exploit auto64746 (Sep 15)
- Re: openssh remote exploit Darren Reed (Sep 15)
- Re: openssh remote exploit Timo Sirainen (Sep 16)
- Re: openssh remote exploit Adam Dyga (Sep 17)
- <Possible follow-ups>
- Re: openssh remote exploit auto64746 (Sep 16)
- Re: openssh remote exploit Diode Trnasistor (Sep 16)
- Re: openssh remote exploit Darren Reed (Sep 16)
- RE: openssh remote exploit Edward W. Ray (Sep 16)
- Re: openssh remote exploit Darren Reed (Sep 16)
- Re: openssh remote exploit Mike Griffin (Sep 16)
- Re: openssh remote exploit KF (Sep 16)
- Re: openssh remote exploit Henning Brauer (Sep 16)
- Re: openssh remote exploit Peter Busser (Sep 19)
- Re: openssh remote exploit petard (Sep 16)