full-disclosure - Re: Symlink vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 25 Oct 2011 18:49:32 +1100
From: xD 0x41 <secn3t@...il.com>
To: vladz <vladz@...zero.fr>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Symlink vulnerabilities

Hello,
    Your 'race condition possibly leading to root'is a myth...
Yes thats maybe because race condition or not, it is ASLR wich will prevent
from ANY rootshell,and Yes, it has bveen tried... You can do better, go
right ahed ;-)
I am betting you thats why it aint being ptached in any hurry, because obv
if you read some notes about it in the committs, you will see they must have
reproduced the said bugs, in and with, more than JUST bzexe even... but
anyhow, your PoC is bs. Make it then ill believe it, ask others, you wont
beat aslr on even vanilla,. So, stop complaining you did not get into patch-
halll of flame.. it was not really going to be ever exploited, or you would
surely not be the one posting this ;)
Anyhow, nice try but no banana.
xd


On 24 October 2011 05:55, vladz <vladz@...zero.fr> wrote:

> On Fri, Oct 21, 2011 at 07:59:59PM -0400, bugs@....dhs.org wrote:
> > bzexe utility:
> >
> > /bin/bzexe:tmp=gz$$
> > /bin/bzexe:rm -f zfoo[12]$$
>
> I reported this one several months ago (in some conditions it could lead
> to a root exploit) and provided an easy solution, but no updates:
>
>  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632862
>
> --
> http://vladz.devzero.fr
> PGP key 8F7E2D3C from pgp.mit.edu
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/