full-disclosure - Re: Linux ELF loader vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4192D883.4010107@mrphp.com.au>
From: ted at mrphp.com.au (Ted Percival)
Subject: Re: Linux ELF loader vulnerabilities

These vulnerabilities appear to exist in 2.6.9 as well. All five buggy 
lines appear verbatim in the 2.6.9 source.

Ted Percival

Paul Starzetz wrote:
> Synopsis:  Linux kernel binfmt_elf loader vulnerabilities
> Product:   Linux kernel
> Version:   2.4 up to to and including 2.4.27, 2.6 up to to and
>            including 2.6.8
> Vendor:    http://www.kernel.org/
> URL:       http://isec.pl/vulnerabilities/isec-0017-binfmt_elf.txt
> CVE:       not assigned
> Author:    Paul Starzetz <ihaquer@...c.pl>
> Date:      Nov 10, 2004
> 
> Issue:
> ======
> 
> Numerous  bugs  have  been  found  in  the Linux ELF binary loader while
> handling setuid binaries.