[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    Re: [Full-disclosure] Advisory: sudo 1.8 Format String Vulnerability
From:       joernchen of Phenoelit <joernchen () phenoelit ! de>
Date:       2012-01-31 16:45:32
Message-ID: 4F281AAC.7010801 () phenoelit ! de
[Download RAW message or body]

Hi,


On 01/31/2012 05:14 PM, Todd C. Miller wrote:
>
> joernchen is correct, it is probably still possible to exploit with
> -D_FORTIFY_SOURCE=2, though it is more difficult.  On systems with
> ASLR and a non-executable stack it should be even harder.

nasty thing is: it's a local exploit so you got nearly unlimited tries
for free =). It will just be noisy in dmesg due to all the segfaults
while brute forcing the right values.


cheers,

joernchen
-- 
joernchen ~ Phenoelit
<joernchen@phenoelit.de> ~ C776 3F67 7B95 03BF 5344
http://www.phenoelit.de  ~ A46A 7199 8B7B 756A F5AC

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[prev in list] [next in list] [prev in thread] [next in thread]