full-disclosure - Re: Advisory: sudo 1.8 Format String Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANtF8NAvjP2mHsEK8ZKDnL03vnveb93Ueqa6y50S9Q2p7qBGBg@mail.gmail.com>
Date: Mon, 6 Feb 2012 09:33:22 -0600
From: Grandma Eubanks <tborland1@...il.com>
To: Michele Orru <antisnatchor@...il.com>
Cc: FD <full-disclosure@...ts.grok.org.uk>
Subject: Re: Advisory: sudo 1.8 Format String Vulnerability

The initial release links to the Phrack article with the information on how
to do this. I'm wondering how much they attempted reliability on aslr issue.

On Mon, Feb 6, 2012 at 5:10 AM, Michele Orru <antisnatchor@...il.com> wrote:

> On Mon, Feb 6, 2012 at 11:56 AM, Roman Medina-Heigl Hernandez
> <roman@...labs.com> wrote:
> > Folks at @vupen seems to have it exploited the hard way.
> >
> > "We successfully exploited the recent Sudo local root / format string
> vuln
> > including full bypass of FORTIFY_SOURCE #GotRoot"
>
> Yep, looks like.
>
> I hope it will not be like with the Chrome Sandbox bypass
> that was achieved through a flash 0day :-)
>
> Maybe this time they exploited sudo through CUPS 1.1 ahah
>
> antisnatchor
>
> >
> > Src:
> > https://twitter.com/#!/VUPEN/status/165454997444767745
> >
> > Cheers,
> > -Román
> >
> > joernchen of Phenoelit escribió:
> >> Hi,
> >>
> >>
> >> On 01/31/2012 05:14 PM, Todd C. Miller wrote:
> >>> joernchen is correct, it is probably still possible to exploit with
> >>> -D_FORTIFY_SOURCE=2, though it is more difficult.  On systems with
> >>> ASLR and a non-executable stack it should be even harder.
> >>
> >> nasty thing is: it's a local exploit so you got nearly unlimited tries
> >> for free =). It will just be noisy in dmesg due to all the segfaults
> >> while brute forcing the right values.
> >>
> >>
> >> cheers,
> >>
> >> joernchen
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
>
>
> --
> /antisnatchor
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/