full-disclosure - Re: Advisory: sudo 1.8 Format String Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 6 Feb 2012 12:10:32 +0100
From: Michele Orru <antisnatchor@...il.com>
To: Roman Medina-Heigl Hernandez <roman@...labs.com>
Cc: FD <full-disclosure@...ts.grok.org.uk>
Subject: Re: Advisory: sudo 1.8 Format String Vulnerability

On Mon, Feb 6, 2012 at 11:56 AM, Roman Medina-Heigl Hernandez
<roman@...labs.com> wrote:
> Folks at @vupen seems to have it exploited the hard way.
>
> "We successfully exploited the recent Sudo local root / format string vuln
> including full bypass of FORTIFY_SOURCE #GotRoot"

Yep, looks like.

I hope it will not be like with the Chrome Sandbox bypass
that was achieved through a flash 0day :-)

Maybe this time they exploited sudo through CUPS 1.1 ahah

antisnatchor

>
> Src:
> https://twitter.com/#!/VUPEN/status/165454997444767745
>
> Cheers,
> -Román
>
> joernchen of Phenoelit escribió:
>> Hi,
>>
>>
>> On 01/31/2012 05:14 PM, Todd C. Miller wrote:
>>> joernchen is correct, it is probably still possible to exploit with
>>> -D_FORTIFY_SOURCE=2, though it is more difficult.  On systems with
>>> ASLR and a non-executable stack it should be even harder.
>>
>> nasty thing is: it's a local exploit so you got nearly unlimited tries
>> for free =). It will just be noisy in dmesg due to all the segfaults
>> while brute forcing the right values.
>>
>>
>> cheers,
>>
>> joernchen
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/



-- 
/antisnatchor

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/