Message-ID: <AA8E3CBBF6E2E7489931D9F30A7BDBD81B2423@zajnbnt006.za.deloitte.com>
From: rdawes at deloitte.co.za (Dawes, Rogan (ZA - Johannesburg))
Subject: ipcs on HP-UX 11.0

Not vulnerable on 10.20, I think.

[rdawes@...th rdawes]$ ls -al /usr/bin/ipcs                             
-r-xr-sr-x   1 bin      sys         16384 Jun 10  1996 /usr/bin/ipcs
[rdawes@...th rdawes]$ /usr/bin/ipcs -C `perl -e 'print "A" x 2232'`
ipcs: memory file unreadable
[rdawes@...th rdawes]$ /usr/bin/ipcs -C `perl -e 'print "A" x 10000'`
ipcs: memory file unreadable
[rdawes@...th rdawes]$ uname -a
HP-UX smith B.10.20 A 9000/831 2009667562 two-user license
[rdawes@...th rdawes]$ 



-----Original Message-----
From: bt@...fi.lt [mailto:bt@...fi.lt] 
Sent: 27 March 2003 10:55 PM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] ipcs on HP-UX 11.0


 Hi!



 There is a buffer overflow in /usr/bin/ipcs on HP-UX 11.0 (other versions
might be
vulnerable too).

 $ ls -al /usr/bin/ipcs
 -r-xr-sr-x   1 bin        sys          28672 Apr 23  1999 /usr/bin/ipcs

 $ /usr/bin/ipcs -C `perl -e 'print "A" x 2232'`
 Segmentation fault

All ipcs vulnerabilities I know about are on HP Tru64.
This system was patched with PHCO_18374 - the lastest patch for ipcs.
I just wondering if it was known before, and if it was - maybe someone has a
working proof
of concept on this.

bt@...fi.lt

--------------------------------------------------------------------
This message was sent using DELFI MailMan - http://mailman.delfi.lt/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-disclosure mailing list
Full-disclosure@...unitysec.com
http://www.immunitysec.com/mailman/listinfo/full-disclosure

Powered by blists - more mailing lists