full-disclosure - Re: [iputils] Integer overflow in iputils ping/ping6 tools

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAH-PCH4fkaxCoJiOuuXY3iSV6kOAxu1T5tRyQAdgCdVn6R9_OQ@mail.gmail.com>
Date: Wed, 14 Mar 2012 13:22:28 +0100
From: Ferenc Kovacs <tyra3l@...il.com>
To: Frankie Cutlass <frankiecutlass12@...il.com>
Cc: full-disclosure@...ts.grok.org.uk, paul.szabo@...ney.edu.au
Subject: Re: [iputils] Integer overflow in iputils
 ping/ping6 tools

technically he never stated that ping keeps the elevated privileges, just
that the binary itself is setuid root, which is correct.

On Wed, Mar 14, 2012 at 5:40 AM, Frankie Cutlass <frankiecutlass12@...il.com
> wrote:

> Incorrect. Ping is setuid root but it drops privs before reaching this code path. Even if you could exploit that for root (you cant) all you would end up with is a shell as your uid and a raw socket..
>
>
-- 
Ferenc Kovács
@Tyr43l - http://tyrael.hu

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/