full-disclosure - OpenBSD implementation of the libc's RPC (portmap) remote DoS.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 22 Nov 2012 17:30:38 +0100
From: auto236751@...hmail.com
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: OpenBSD implementation of the libc's RPC
	(portmap) remote DoS.

Hi list,

As some of you could recently notice a new OpenBSD 5.2 was released.
To celebrate it we provide you with the shiny ~9yearer, which is
probably heck of a long time.
Another funny thing about this bug is, that it's only OpenBSD's libc
specific.
But there is no much excitement about it though, as we weren't able to
achive RCE and the
portmap is disabled by default. Maybe some of you will have more luck
with it than we had.
The bug is also interesting because of it's nature. Why? Check it by
yourself (hint: global variables).
As stated in
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/rpc/svc_tcp.c#rev1.23,
many people tested it and weren't able to spot it.

Happy hacking...

$ cat >> openbsd_libc_portmap.c 
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/