full-disclosure - Re: surfboard1.1.6 local exploit.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200405131247.25198.meredydd@everybuddy.com>
From: meredydd at everybuddy.com (Meredydd)
Subject: Re: surfboard1.1.6 local exploit.

I'm...mildly impressed. Someone's still *using* that thing? Not that 
things have changed in this regard, but the latest version is 1.1.9, 
anyway.

Serious question, actually - they shouldn't exist, I know (believe me, I 
don't still code like that...), but exactly how severe is a hole such 
as this, which is only exploitable by the user who is running the 
daemon in the first place? Unless you're doing something like running 
the daemon as root, with a user-modifiable config file (at which point 
you have much more serious problems, like CGI), this doesn't actually 
escalate someone's privilege at all.

On Tuesday 11 May 2004 21:19, Anonymous wrote:
> Solution:
>
> fluffy has written a great cmd line hack to solve the problem:
>
> for i in `locate surfboard`; do rm -rf $i ; done
>
> Should do the trick ;)
Unfortunately, fluffy has neglected the file actually 
responsible, /usr/local/bin/surfd. Sorry to break it to him/her/it :^)

fluffy also forgot the next line, which goes something along the lines 
of:
apt-get install apache

Seriously. You shouldn't be using this lump of junk. Anyway, you 
*definitely* shouldn't be using 1.1.6, cause there's a good couple of 
arbitrary-traversal holes in there, along with tons of bugs (something 
you'd know if you read the archives of this list). 1.1.9 was the latest 
at time of announcement, and v1.1.10 is now on the sourceforge site, 
for any fool who's still using it...

Meredydd