lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 2 Dec 2012 16:40:32 +0100
From: king cope <>
Subject: Re: MySQL (Linux) Heap Based Overrun PoC Zeroday

When you look into the heap and stack overrun the first obstacle to
exploit the bugs is that MySQL does not allow all plain 0 to 255
characters, this means the exploiter would have to use unicode
translation in order to exploit the bugs (therefore these are PoCs
only by now). If the exploiter managed to execute code on default
installs without your mentioned protections it might be possible to
circumvent them, to be honest I didn't have a look into these
optimizations and protections, it's hard enough to exploit it without
these restrictions applied.

2012/12/1 Jeffrey Walton <>:
> Hi Kingcope,
> # As seen below $edx and $edi are fully controlled,
> # the current instruction is
> # => 0x83a6b24 <free_root+180>:   mov    (%edx),%edi
> # this means we landed in a place where 4 bytes can be controlled by 4 bytes
> # with this function pointers and GOT entries can be rewritten to
> execute arbritrary code
> Out of curiosity, is this exploitable when using hardened toolchain
> settings? Specifically, -z,noexecheap, -z,now, and -z,relro? For
> no-exec heaps., you need to be on Gentoo or other platforms which
> offer the remediation.
> Jeff
> On Sat, Dec 1, 2012 at 4:26 PM, king cope
> <> wrote:
>> (see attachment)
>> Cheerio,
>> Kingcope
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter:
>> Hosted and sponsored by Secunia -

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists