bugtraq - PoC for CVE-2010-1869 (ghostscript) and CVE-2010-1039 (rpc.pcnfsd)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <50D13E31158CB84E8421A703294682FB142038EE1A@USEXCHANGE.ad.checkpoint.com>
Date: Sun, 18 Jul 2010 11:31:54 -0700
From: Rodrigo Branco <rbranco@...ckpoint.com>
To: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: PoC for CVE-2010-1869 (ghostscript) and CVE-2010-1039 (rpc.pcnfsd)

Dear List,

I'm writing in behalf of the Check Point Vulnerability Discovery Team to provide the PoC for two vulnerabilities released in the past month:
	- CVE-2010-1869 (Ghostscript stack overflow):
		o http://www.kernelhacking.com/rodrigo/exploits/gs_bsd.pl.txt  -> Working exploit against PCBSD, exploiting the vulnerability thru CUPS
		o http://www.kernelhacking.com/rodrigo/exploits/gs_ps.pl.txt -> To create a .ps file just to trigger the vulnerability

	- CVE-2010-1039 (rpc.pcnfsd format string):
		o http://www.kernelhacking.com/rodrigo/exploits/pcnfsd.c -> RPC message to trigger the format string, already supporting RPC fragmentation

We are leading a big change in the way vendors report vulnerabilities, providing PoC code so customers and interested parties are able to test the fixes and
IPS systems.  We provide such PoC code to the public at least a month AFTER the release of the fix and immediately per request of interested parties.

Additionally, Check Point is committed to responsible disclosure procedures, allowing vendors ample time to respond, alert customers and time to apply the 
fixes before release.

Best Regards,

Rodrigo.

--
Rodrigo Rubira Branco
Senior Security Researcher
Vulnerability Discovery Team (VDT)
Check Point Software Technologies