Full Disclosure mailing list archives
Re: Advisory: sudo 1.8 Format String Vulnerability
From: joernchen of Phenoelit <joernchen () phenoelit de>
Date: Tue, 31 Jan 2012 17:45:32 +0100
Hi, On 01/31/2012 05:14 PM, Todd C. Miller wrote:
joernchen is correct, it is probably still possible to exploit with -D_FORTIFY_SOURCE=2, though it is more difficult. On systems with ASLR and a non-executable stack it should be even harder.
nasty thing is: it's a local exploit so you got nearly unlimited tries for free =). It will just be noisy in dmesg due to all the segfaults while brute forcing the right values. cheers, joernchen -- joernchen ~ Phenoelit <joernchen () phenoelit de> ~ C776 3F67 7B95 03BF 5344 http://www.phenoelit.de ~ A46A 7199 8B7B 756A F5AC _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Advisory: sudo 1.8 Format String Vulnerability joernchen of Phenoelit (Jan 30)
- Re: Advisory: sudo 1.8 Format String Vulnerability Henri Salo (Jan 30)
- Re: Advisory: sudo 1.8 Format String Vulnerability Henri Salo (Jan 30)
- Re: Advisory: sudo 1.8 Format String Vulnerability nicolas vigier (Jan 30)
- Re: Advisory: sudo 1.8 Format String Vulnerability Agostino Sarubbo (Jan 31)
- Re: Advisory: sudo 1.8 Format String Vulnerability Todd C. Miller (Jan 31)
- Re: Advisory: sudo 1.8 Format String Vulnerability joernchen of Phenoelit (Jan 31)
- Re: Advisory: sudo 1.8 Format String Vulnerability root (Jan 30)