Security Incidents mailing list archives
Y2K bug in Shadow IDS
From: patrick () PINE NL (Patrick Oonk)
Date: Sun, 2 Jan 2000 13:57:58 +0100
Hi, The shadow IDS contains a programming mistake that breaks many scripts in the suite. The author assumed at some point that the output of the year value in Perl's date functions is a 2 digit number which it isn't. In 2000 the value of $year is '100'. I made a small fix which still is not pretty, but going to a 4 digit year would break many other things in the scripts, and this fix will work for the next 99 years anyway :) I changed the top of 'sensor/variables.ph' into # We need various timestamps all over the place @T = localtime; if ($T[5] > 99) { $T[5] -= 100; } By the way, the Shadow perl scripts also use /tmp a lot with predictable file names, so local exploits are possible, but this is more of a Bugtraq issue I guess. p. -- Patrick Oonk - PO1-6BONE - patrick () pine nl - www.pine.nl/~patrick Pine Internet B.V. GOAT666-RIPE PGP key ID BE7497F1 Tel: +31-70-3111010 - Fax: +31-70-3111011 - http://www.pine.nl/ -- Pine Security Digest - http://security.pine.nl/ (Dutch) ---- Excuse of the day: Your excuse is: it has Intel Inside <HR NOSHADE> <UL> <LI>application/pgp-signature attachment: stored </UL>
Current thread:
- Re: port 119, (continued)
- Re: port 119 R a v e N (Jan 05)
- Re: port 119 Scott Laws (Jan 04)
- Writeup: it. TLD going astray Arrigo Triulzi (Jan 03)
- Computer Forsenics System Administrator (Jan 03)
- Re: Computer Forsenics-> www.fish.com/forensics mike (Jan 03)
- traceroute ICMP packets Laszlo Fabian (Jan 04)
- Re: traceroute ICMP packets M J (Jan 04)
- Re: traceroute ICMP packets Larry Canup (Jan 18)
- Re: ICMP time exceed in-transit packets Paul Cardon (Jan 02)
- Re: Port Scan on 371... Etaoin Shrdlu (Jan 02)
- Re: Port Scan on 371... Christopher Wilson (Jan 02)
- correlation between porscans and local activity Thomas Molina (Jan 02)
- Re: correlation between porscans and local activity Sean Sosik-Hamor (Jan 03)
- ADMROCKS McNab, Chris (Jan 03)
- R: correlation between porscans and local activity Raistlin (Jan 04)
- Re: R: correlation between porscans and local activity Michael Babcock (Jan 12)