fbsd 3.3 ospf_monitor research

[btellier () USA NET (Brock Tellier)]

I wonder if anyone could research fbsd 3.3's ospf_monitor program.  It has an
exploitable buffer overflow:
bash-2.03$ ./smashf 1100 600
Using address: 0xbfbfd834
bash-2.03$ ospf_monitor AA$RET
listening on 0.0.0.0.1495
monconf: Can't open monitor conf file 

...

uid=1000 euid=1000 gid=1000 egid=1000
bash-2.03$

But evidently drops privs before it occurs (apparently after it binds to port
1495).  Now why, if it binds to an unpriv'd port, would it have suidroot privs
to begin with?  And what could command execution actually get us if not a
rootshell?

Brock Tellier
UNIX Systems Administrator

____________________________________________________________________
Get free email and a permanent address at http://www.netaddress.com/?N=1