full-disclosure - Re: Advisory: sudo 1.8 Format String Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4F281AAC.7010801@phenoelit.de>
Date: Tue, 31 Jan 2012 17:45:32 +0100
From: joernchen of Phenoelit <joernchen@...noelit.de>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Advisory: sudo 1.8 Format String Vulnerability

Hi,

On 01/31/2012 05:14 PM, Todd C. Miller wrote:
>
> joernchen is correct, it is probably still possible to exploit with
> -D_FORTIFY_SOURCE=2, though it is more difficult.  On systems with
> ASLR and a non-executable stack it should be even harder.

nasty thing is: it's a local exploit so you got nearly unlimited tries
for free =). It will just be noisy in dmesg due to all the segfaults
while brute forcing the right values.

cheers,

joernchen
-- 
joernchen ~ Phenoelit
<joernchen@...noelit.de> ~ C776 3F67 7B95 03BF 5344
http://www.phenoelit.de  ~ A46A 7199 8B7B 756A F5AC

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/