Vulnerability Development mailing list archives

Re: krb5 1.1.1

From: tschroed () ZWEKNU ORG (Trevor Schroeder)
Date: Wed, 31 May 2000 22:52:07 -0400


On Mon, May 22, 2000 at 11:38:43PM +0200, Mariusz Woloszyn wrote:

I was trying to play with kerberos bugs, but the binary I downloaded
from redhat.com does not want to segfault. The BT posts were saying that
default RH 6.2 without kerberos stuff contains v4rcp that is suid root
and segfaults when tested by sample exploit.  Does anyone have
vulnerable sources and/or binaries?


http://web.mit.edu/kerberos/www/ might be a good place to start. ;)

--
"Necessity is the mother of lean code."
http://www.zweknu.org/ for PGP key and more.

Current thread:

Re: krb5 1.1.1 Trevor Schroeder (May 31)
- Re: krb5 1.1.1 Mariusz Woloszyn (Jun 05)
  - ADV: /con/con is yet exploitable on most fservs Paulo Ribeiro (Jun 07)
    - Re: ADV: /con/con is yet exploitable on most fservs Cam (Jun 08)
    - Re: A<D>V: /con/con is yet exploitable on most fservs Niall Smart (Jun 08)
    - weird bug found marco (Jun 09)
    - Re: weird bug found hypoclear - lUSt - (Linux Users Strike Today) (Jun 09)
    - ie5 and .doc URLs Olivier Thereaux (Jun 09)
    - Re: ie5 and .doc URLs Chris Tobkin (Jun 09)
    - Re: ie5 and .doc URLs Olle Segerdahl (Jun 09)
    - mdaemon 2.8.5.0 DoS Craig (Jun 09)

(Thread continues...)