Vulnerability Development mailing list archives
Re[2]: New bugs discovered!
From: Mariusz Mazur <mariusz () isn pl>
Date: Mon, 19 Nov 2001 18:05:06 +0100
On 2001-11-19 Larry W. Cashdollar wrote the folowyng: LWC> I think we are going to find a new era of buffer overflows, not in LWC> the daemons themselves but the user utilities that they call. Overflows LWC> in non-setuid binaries might be worth cataloging if these binaries are LWC> being called by applications that are listening to a socket. LWC> This might be a good time to be thinking about what relies on what. I remember reading about something similar (if anybody knows something more about it I would be happy to refresh my memory). Many admins did a |mail from cron and they did it in a way that made it possible for attackers to execute commands (mail has/had such a feature). The conclusion was that we are using (though I was sure the problem was eliminated long ago... guess I'm to young to know better :) programs not designed to be secure in ways which require them to be secure (who cares if your grep does a segfault? it's not suid!... but remember all those maintenance scripts run from cron suid root? every third line does a |grep... oops I did it again :). -- Mariusz Mazur "One Ring to bring them all and in the darkness bind them" rem begin JenniferLopez_Naked.jpg.vbs :)
Current thread:
- Re: New bugs discovered!, (continued)
- Re: New bugs discovered! Alex Butcher (vuln-dev) (Nov 19)
- Re: New bugs discovered! Roger Burton West (Nov 19)
- Re: New bugs discovered! Fabio Roccatagliata (Nov 19)
- Re: New bugs discovered! Respect (Nov 19)
- Re: New bugs discovered! Yaroslav Klyukin (Nov 18)
- Re: New bugs discovered! Crist J. Clark (Nov 19)
- Re: New bugs discovered! Robert Jaroszuk (Nov 19)
- Re: New bugs discovered! Naseer Bhatti (Nov 19)
- Re: New bugs discovered! Larry W. Cashdollar (Nov 18)
- Re: New bugs discovered! Syzop (Nov 19)
- Re[2]: New bugs discovered! Mariusz Mazur (Nov 19)
- Re: New bugs discovered! Chris D. Sloan (Nov 18)
- Re: New bugs discovered! c0n (Nov 18)
- Re: New bugs discovered ! Baba Bogdan (Nov 19)
- Re: New bugs discovered! Brent Wrisley (Nov 19)
- Re: New bugs discovered! Joep Vesseur (Nov 19)
- Re: New bugs discovered! Ferdinand herve (Nov 19)
- Re: New bugs discovered! Caiaphas Pechorin (Nov 19)
- Re: New bugs discovered! Cabezon Aurélien (Nov 19)
- Re: New bugs discovered! Bernhard Rosenkraenzer (Nov 19)
- Re: New bugs discovered! Baba Bogdan (Nov 19)