full-disclosure - GNU gcc vuln. < 3.4.3 local root (.php)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: andfarm at teknovis.com (Andrew Farmer)
Subject: GNU gcc vuln. < 3.4.3 local root (.php)

On 17 Jan 2005, at 00:30, ZzagorR ZzagorR wrote:
> #!/usr/bin/php -a
> <?
> /*
> GNU gcc vuln. < 3.4.3
> By ZzagorR (MARMARA UNIVERSITY)
> zzagorrzzagorr@...mail.com
> http://www.rootbinbash.com
> thanks to [NST]
> ah vizeler ahhhhh
> */
<snip>

Ha ha ha.

Old "vulnerability". Equivalent to:

>> /* fake_vuln.c */
>> int getuid(void) { return 0; }
>> int geteuid(void) { return 0; }
>> int getgid(void) { return 0; }
>
> sh % gcc -shared fake_vuln.c -o fake_vuln.so
> sh % LD_PRELOAD=`pwd`/fake_vuln.so /bin/sh
> sh # id
> uid=0(root) gid=0(root) <etc etc etc>
> sh # cat /etc/shadow
> cat: /etc/shadow: Permission denied

The sad part is that rootbinbash.com has posted this as a real 
vulnerability.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050117/95598c31/PGP.bin