Vulnerability Development mailing list archives
Re: Remote exploitation of network scanners?
From: Domenico De Vitto <dom () DEVITTO DEMON CO UK>
Date: Fri, 1 Sep 2000 10:12:49 +0100
Bluefish, Snoop is basically Sun's home-grown 'tcpdump', and though you can always sandbox (and hope they can't bust your chroot!), very few (e.g. none) people are going to expect a vendor supplied 'listen-only' tool to give bad guys remte root, so.... Dom -----Original Message----- From: Bluefish (P.Magnusson) [mailto:11a () gmx net] Sent: 31 August 2000 12:37 To: Domenico De Vitto Cc: VULN-DEV () SECURITYFOCUS COM Subject: Re: Remote exploitation of network scanners? I'm not overly familiar with this "Snoop" or any other of these scanners, but.... Can't they be placed inside some kind of home-made containment (sandbox, or what ever word you prefere). Such as chrooting, dropping capability to chroot and so on. [would be better if the developers themselves adding this to their scanners, but until then]
Snoop RPC buffer overflow. Very amusing, especially if you use snoop 24x7 as a kinda homegrown IDS
;-)
Dom PS. Oh, and yes, it's a remote root thang.
..:::::::::::::::::::::::::::::::::::::::::::::::::.. http://www.11a.nu || http://bluefish.11a.nu eleventh alliance development & security team
Current thread:
- Re: Remote exploitation of network scanners? Domenico De Vitto (Sep 01)
- Re: Remote exploitation of network scanners? Bluefish (P.Magnusson) (Sep 01)
- <Possible follow-ups>
- Re: Remote exploitation of network scanners? Peter Pentchev (Sep 02)
- Re: Remote exploitation of network scanners? Andrew Scott Reisse (Sep 02)
- Re: Remote exploitation of network scanners? Peter Pentchev (Sep 02)
- Re: Remote exploitation of network scanners? Andrew Scott Reisse (Sep 02)