full-disclosure - formatfun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <44242378.5090004@gmx.net>
Date: Fri Mar 24 16:51:39 2006
From: kingcope at gmx.net (kcope)
Subject: formatfun

Hello,

mod_ssl:
/httpd-2.0.48/modules/ssl/ssl_engine_kernel.c (also in 2.0.55)
proto:        
 ap_log_error(constchar*file,intline,intlevel,apr_status_tstatus,constserver_rec*s,constchar*fmt,...) 

code:         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, buff);
is this exploitable?

sendmail 8.13.5:
sendmail-8.13.5/sendmail/main.c
proto:      sm_setproctitle(boolstatus,ENVELOPE*e,constchar*fmt,...)  
code:     sm_setproctitle(true, CurEnv, qtype);
_NOT_ exploitable because sendmail DROPS PRIVILEGES! mailqueue anyone?

openssh-4.0p1:
file: openssh-4.0p1/openssh-4.0p1/auth1.c
proto: packet_disconnect(constchar*fmt,...)  
code:  packet_disconnect(msg);
i guess thats not exploitable since msg is not user supplied.

any pointers from the list?

- - kcope