| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue May 31 11:58:33 2005 From: guninski at guninski.com (Georgi Guninski) Subject: Re: qmail security guarantee questioned On Thu, May 26, 2005 at 12:35:48PM +0100, Justin Murdock wrote: > you have yet to demonstrate that this bug will allow the system to be > compromised - you'll be able to save a file in /var/qmail/queue, then > exec it, or a system binary - but you'll still be stuck with very poor > privileges. the program at: http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html#qpopup executes code with root privileges via qmail-popup for me. the same commands zero writing bug. notes for the qmail fanatics: - this is not a dos, this is remote code execution with root privileges - with local access the offsets are easily found, so exploitation is very reliable in this case - djb gives installation instructions in INSTALL which allow root compromise - the payload consists of "int3" which produces trace trap for the microsoft certified solitaire experts (MCSEs) who can't get it -- where do you want bill gates to go today?
Powered by blists - more mailing lists