[prev in list] [next in list] [prev in thread] [next in thread]
List: ntp-bugs
Subject: [ntp:bugs] Re: NTPD secure technical question
From: "David L. Mills" <mills () udel ! edu>
Date: 2005-06-24 16:29:56
Message-ID: 42BC3504.3080405 () udel ! edu
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
Resurrección Mazo González
You have written in a font very difficult to read. From what I can see,
your trace is not what is supported in the software that leaves here.
Unless you provide configuration and trace compatible with the
distribution, I can't help you.
Dave
Resurrección Mazo González wrote:
> Hi! First: I have written to hackers@ntp.org <mailto:hackers@ntp.org>,
> but mailserver has rejected my mail. So I write you using contac mail
> provided.
>
> I'm testing ntp of ntp.org, but I have problems to run it using
> another user who differs root user. Is it possible to run ntpd using
> another user? In ntp-4.2.0 (latest stable version), I can see the ntpd
> option parameter "-u user[:group]" and -i option to chroot the
> instance, but it crashes as appers in this ltrace trace:
>
> gentoo bin # ltrace ./ntpd -u ntp
> SYS_uname(0xbffff6fc)
> = 0
> SYS_brk(NULL)
> = 0x8123000
> SYS_access(0xb7ffbb40, 4, 0xb8000fd4, 0,
> 0xb7ffbb40) = -2
> SYS_open("/etc/ld.so.cache", 0,
> 00) = 3
> SYS_fstat64(3, 0xbfffefe8, 0xb8000fd4, 3,
> 0xb800146c) = 0
> SYS_mmap2(0, 66718, 1, 2,
> 3) = 0xb7fda000
> SYS_close(3)
> = 0
> SYS_open("/lib/libm.so.6", 0,
> 00) = 3
> SYS_read(3, "\177ELF\001\001\001",
> 512) = 512
> SYS_fstat64(3, 0xbffff074, 0xb8000fd4, 15,
> 0xb800166c) = 0
> SYS_mmap2(0, 139424, 5, 2050,
> 3) = 0xb7fb7000
> SYS_mmap2(0xb7fd8000, 8192, 3, 2066,
> 3) = 0xb7fd8000
> SYS_close(3)
> = 0
> SYS_open("/usr/lib/libcrypto.so.0.9.7", 0,
> 00) = 3
> SYS_read(3, "\177ELF\001\001\001",
> 512) = 512
> SYS_fstat64(3, 0xbffff058, 0xb8000fd4, 28,
> 0xb800166c) = 0
> SYS_mmap2(0, 4096, 3, 34,
> -1) = 0xb7fb6000
> SYS_mmap2(0, 0x000fbe58, 5, 2050,
> 3) = 0xb7eba000
> SYS_mmap2(0xb7fa1000, 73728, 3, 2066,
> 3) = 0xb7fa1000
> SYS_mmap2(0xb7fb3000, 11864, 3, 50,
> -1) = 0xb7fb3000
> SYS_close(3)
> = 0
> SYS_open("/usr/lib/libelf.so.1", 0,
> 00) = 3
> SYS_read(3, "\177ELF\001\001\001",
> 512) = 512
> SYS_fstat64(3, 0xbffff03c, 0xb8000fd4, 21,
> 0xb800166c) = 0
> SYS_mmap2(0, 71560, 5, 2050,
> 3) = 0xb7ea8000
> SYS_mmap2(0xb7eb9000, 4096, 3, 2066,
> 3) = 0xb7eb9000
> SYS_close(3)
> = 0
> SYS_open("/lib/libc.so.6", 0,
> 00) = 3
> SYS_read(3, "\177ELF\001\001\001",
> 512) = 512
> SYS_fstat64(3, 0xbffff020, 0xb8000fd4, 15,
> 0xb800166c) = 0
> SYS_mmap2(0, 0x00115d2c, 5, 2050,
> 3) = 0xb7d92000
> SYS_mmap2(0xb7ea2000, 16384, 3, 2066,
> 3) = 0xb7ea2000
> SYS_mmap2(0xb7ea6000, 7468, 3, 50,
> -1) = 0xb7ea6000
> SYS_close(3)
> = 0
> SYS_open("/lib/libdl.so.2", 0,
> 00) = 3
> SYS_read(3, "\177ELF\001\001\001",
> 512) = 512
> SYS_fstat64(3, 0xbfffeee8, 0xb8000fd4, 16,
> 0xb800166c) = 0
> SYS_mmap2(0, 12392, 5, 2050,
> 3) = 0xb7d8e000
> SYS_mmap2(0xb7d90000, 8192, 3, 2066,
> 3) = 0xb7d90000
> SYS_close(3)
> = 0
> SYS_mmap2(0, 4096, 3, 34,
> -1) = 0xb7d8d000
> SYS_mprotect(0xb7d90000, 4096, 1, 0xb7fb67d8,
> 0xb7fb67d8) = 0
> SYS_mprotect(0xb7ea2000, 8192, 1, 0xb7fb6520,
> 0xb7fb6520) = 0
> SYS_mprotect(0xb7fd8000, 4096, 1, 0xb8001c60,
> 0xb8001c60) = 0
> SYS_mprotect(0xb8000000, 4096, 1, 0xb80011c0,
> 0xb80011c0) = 0
> SYS_set_thread_area(0xbffff690, 0xb8000fd4, 243, 0,
> 0xb80011c0) = 0
> SYS_munmap(0xb7fda000,
> 66718) = 0
> SYS_open("/dev/urandom", 0,
> 027777774250) = 3
> SYS_read(3, "\300\226\375\037",
> 4) = 4
> SYS_close(3)
> = 0
> SYS_umask(00)
> = 022
> SYS_umask(022)
> = 00
> SYS_getuid32(0xb7ea3ff4, 0xb7da7176, 0xb7ea3ff4, 3,
> 0xbffff954) = 0
> SYS_gettimeofday(0xbffff7c8, 0, 0xbffff818, 3,
> 0xbffff954) = 0
> SYS_clone(0x01200011, 0, 0, 0, 0xb7d8d908ltrace: dict.c:117:
> dict_apply_to_all: Assertion `d' failed.
> Aborted
>
> I have tried to compile it using enable-options: --enable-clockctl and
> --enable-linuxcaps. But same results. It crashes.
>
> I have tried to run ntpd as other user with privileges over used
> files, but it crashes:
> ntp@gentoo bin $ ltrace -S ./ntpd
> SYS_uname(0xbffff7bc)
> = 0
> SYS_brk(NULL)
> = 0x8123000
> SYS_access(0xb7ffbb40, 4, 0xb8000fd4, 0,
> 0xb7ffbb40) = -2
> SYS_open("/etc/ld.so.cache", 0,
> 00) = 3
> SYS_fstat64(3, 0xbffff0a8, 0xb8000fd4, 3,
> 0xb800146c) = 0
> SYS_mmap2(0, 66718, 1, 2,
> 3) = 0xb7fda000
> SYS_close(3)
> = 0
> SYS_open("/lib/libm.so.6", 0,
> 00) = 3
> SYS_read(3, "\177ELF\001\001\001",
> 512) = 512
> SYS_fstat64(3, 0xbffff134, 0xb8000fd4, 15,
> 0xb800166c) = 0
> SYS_mmap2(0, 139424, 5, 2050,
> 3) = 0xb7fb7000
> SYS_mmap2(0xb7fd8000, 8192, 3, 2066,
> 3) = 0xb7fd8000
> SYS_close(3)
> = 0
> SYS_open("/usr/lib/libcrypto.so.0.9.7", 0,
> 00) = 3
> SYS_read(3, "\177ELF\001\001\001",
> 512) = 512
> SYS_fstat64(3, 0xbffff118, 0xb8000fd4, 28,
> 0xb800166c) = 0
> SYS_mmap2(0, 4096, 3, 34,
> -1) = 0xb7fb6000
> SYS_mmap2(0, 0x000fbe58, 5, 2050,
> 3) = 0xb7eba000
> SYS_mmap2(0xb7fa1000, 73728, 3, 2066,
> 3) = 0xb7fa1000
> SYS_mmap2(0xb7fb3000, 11864, 3, 50,
> -1) = 0xb7fb3000
> SYS_close(3)
> = 0
> SYS_open("/usr/lib/libelf.so.1", 0,
> 00) = 3
> SYS_read(3, "\177ELF\001\001\001",
> 512) = 512
> SYS_fstat64(3, 0xbffff0fc, 0xb8000fd4, 21,
> 0xb800166c) = 0
> SYS_mmap2(0, 71560, 5, 2050,
> 3) = 0xb7ea8000
> SYS_mmap2(0xb7eb9000, 4096, 3, 2066,
> 3) = 0xb7eb9000
> SYS_close(3)
> = 0
> SYS_open("/lib/libc.so.6", 0,
> 00) = 3
> SYS_read(3, "\177ELF\001\001\001",
> 512) = 512
> SYS_fstat64(3, 0xbffff0e0, 0xb8000fd4, 15,
> 0xb800166c) = 0
> SYS_mmap2(0, 0x00115d2c, 5, 2050,
> 3) = 0xb7d92000
> SYS_mmap2(0xb7ea2000, 16384, 3, 2066,
> 3) = 0xb7ea2000
> SYS_mmap2(0xb7ea6000, 7468, 3, 50,
> -1) = 0xb7ea6000
> SYS_close(3)
> = 0
> SYS_open("/lib/libdl.so.2", 0,
> 00) = 3
> SYS_read(3, "\177ELF\001\001\001",
> 512) = 512
> SYS_fstat64(3, 0xbfffefa8, 0xb8000fd4, 16,
> 0xb800166c) = 0
> SYS_mmap2(0, 12392, 5, 2050,
> 3) = 0xb7d8e000
> SYS_mmap2(0xb7d90000, 8192, 3, 2066,
> 3) = 0xb7d90000
> SYS_close(3)
> = 0
> SYS_mmap2(0, 4096, 3, 34,
> -1) = 0xb7d8d000
> SYS_mprotect(0xb7d90000, 4096, 1, 0xb7fb67d8,
> 0xb7fb67d8) = 0
> SYS_mprotect(0xb7ea2000, 8192, 1, 0xb7fb6520,
> 0xb7fb6520) = 0
> SYS_mprotect(0xb7fd8000, 4096, 1, 0xb8001c60,
> 0xb8001c60) = 0
> SYS_mprotect(0xb8000000, 4096, 1, 0xb80011c0,
> 0xb80011c0) = 0
> SYS_set_thread_area(0xbffff750, 0xb8000fd4, 243, 0,
> 0xb80011c0) = 0
> SYS_munmap(0xb7fda000,
> 66718) = 0
> SYS_open("/dev/urandom", 0,
> 027777774550) = 3
> SYS_read(3, "Yx@V",
> 4) = 4
> SYS_close(3)
> = 0
> SYS_umask(00)
> = 022
> SYS_umask(022)
> = 00
> SYS_getuid32(0xb7ea3ff4, 0xb7da7176, 0xb7ea3ff4, 1,
> 0xbffffa14) = 123
> SYS_brk(NULL)
> = 0x8123000
> SYS_brk(0x8144000)
> = 0x8144000
> SYS_time(0xbffff16c, 0, 0xb7ea3ff4, 0xbffff16c,
> 0x08123008) = 0x42bc1f18
> SYS_open("/etc/localtime", 0,
> 0666) = 3
> SYS_fstat64(3, 0xbfffefec, 0xb7ea3ff4, 0,
> 0xb7e95db8) = 0
> SYS_fstat64(3, 0xbfffeeb0, 0xb7ea3ff4, 0x081251a0,
> 8192) = 0
> SYS_mmap2(0, 4096, 3, 34,
> -1) = 0xb7fea000
> SYS_read(3, "TZif",
> 4096) = 700
> SYS_close(3)
> = 0
> SYS_munmap(0xb7fea000,
> 4096) = 0
> SYS_open("/etc/localtime", 0,
> 0666) = 3
> SYS_fstat64(3, 0xbfffeed0, 0xb7ea3ff4, 0,
> 0xb7e95db8) = 0
> SYS_close(3)
> = 0
> SYS_open("/etc/localtime", 0,
> 0666) = 3
> SYS_fstat64(3, 0xbfffed74, 0xb7ea3ff4, 0,
> 0xb7e95db8) = 0
> SYS_close(3)
> = 0
> SYS_open("/etc/localtime", 0,
> 0666) = 3
> SYS_fstat64(3, 0xbfffed74, 0xb7ea3ff4, 0,
> 0xb7e95db8) = 0
> SYS_close(3)
> = 0
> SYS_rt_sigaction(13, 0xbffff07c, 0xbfffefec, 8,
> 0xb7ea3ff4) = 0
> SYS_socketcall(1, 0xbffff108, 0xb7ea3ff4, 0,
> 0xbffff1c8) = 3
> SYS_fcntl64(3, 2, 1, 1,
> 0xb7ea3ff4) = 0
> SYS_socketcall(3, 0xbffff108, 0xb7ea3ff4, 0,
> -32) = 0
> SYS_socketcall(9, 0xbffff138, 0xb7ea3ff4, 0,
> 0xbffff1c8) = 64
> SYS_rt_sigaction(13, 0xbffff07c, 0, 8,
> 0xb7ea3ff4) = 0
> SYS_exit_group(1 <unfinished ...>
> +++ exited (status 1) +++
>
> Most curiosly that ntpd syntax don't show me -u or -i options to use:
>
> usage: bin/ntpd [ -abdgmnx ] [ -c config_file ] [ -e e_delay ]
> [ -f freq_file ] [ -k key_file ] [ -l log_file ]
> [ -p pid_file ] [ -r broad_delay ] [ -s statdir ]
> [ -t trust_key ] [ -v sys_var ] [ -V default_sysvar ]
> [ -P fixed_process_priority ]
>
> Any suggestion about? Thanks a lot!
>
>
> My best wishes,
>
> --------------------------------------------------
> Resurrección Mazo González
> rmazgon@canarias.org <mailto:rmazgon@canarias.org>
> --------------------------------------------------
> Este correo electrónico y, en su caso, cualquier fichero anexo al
> mismo, contiene información de carácter confidencial exclusivamente
> dirigida a su destinatario o destinatarios. Queda prohibida su
> divulgación, copia o distribución a terceros sin la previa
> autorización escrita. En el caso de haber recibido este correo
> electrónico por error, se ruega notifíquese inmediatamente esta
> circunstancia mediante reenvío a la dirección electrónica del remitente.
["unnamed.html" (text/html)]
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Resurrección Mazo González<br>
<br>
You have written in a font very difficult to read. From what I can see,
your trace is not what is supported in the software that leaves here.
Unless you provide configuration and trace compatible with the
distribution, I can't help you.<br>
<br>
Dave<br>
<br>
</tt><tt>Resurrección Mazo González wrote:</tt>
<blockquote
cite="mid09fe01c578d5$c2863670$dc3e8c0a@gobiernodecanarias.net"
type="cite">
<meta http-equiv="Content-Type" content="text/html; ">
<meta content="MSHTML 6.00.2900.2627" name="GENERATOR">
<DEFANGED_style_0 </style>
<DEFANGED_div><tt><font size="2"></font></tt>
<DEFANGED_div><tt><font size="2"><font size="2">
<DEFANGED_div><font size="2">Hi! First: I have written to <a
href="mailto:hackers@ntp.org">hackers@ntp.org</a>, but mailserver has
rejected my mail. So I write you using contac mail provided.</font></DEFANGED_div>
<DEFANGED_div> </DEFANGED_div>
<DEFANGED_div><font size="2">I'm testing ntp of ntp.org, but I have problems
to run it using another user who differs root user. Is it possible to
run ntpd using another user? In ntp-4.2.0 (latest stable version), I
can see the ntpd option parameter "-u user[:group]" and -i option to
chroot the instance, but it crashes as appers in this ltrace \
trace:</font></DEFANGED_div> <DEFANGED_div> </DEFANGED_div>
<DEFANGED_div><font size="1">gentoo bin # ltrace ./ntpd -u ntp <br>
SYS_uname(0xbffff6fc)   \
; & \
nbsp; &nb \
sp;
= 0<br>
SYS_brk(NULL) & \
nbsp; &nb \
sp;   \
;
= 0x8123000<br>
SYS_access(0xb7ffbb40, 4, 0xb8000fd4, 0,
0xb7ffbb40) &nb \
sp; \
= -2<br> SYS_open("/etc/ld.so.cache", 0,
00)   \
; & \
nbsp; \
= 3<br> SYS_fstat64(3, 0xbfffefe8, 0xb8000fd4, 3,
0xb800146c) &nb \
sp; \
= 0<br> SYS_mmap2(0, 66718, 1, 2,
3) \
&n \
bsp; \
= 0xb7fda000<br> SYS_close(3) &nb \
sp;   \
; & \
nbsp; &nb \
sp;
= 0<br>
SYS_open("/lib/libm.so.6", 0,
00)   \
; & \
nbsp; \
= 3<br> SYS_read(3, "\177ELF\001\001\001",
512) &nbs \
p; \
= 512<br> SYS_fstat64(3, 0xbffff074, 0xb8000fd4, 15,
0xb800166c) &nb \
sp; = \
0<br> SYS_mmap2(0, 139424, 5, 2050,
3) \
&n \
bsp; \
= 0xb7fb7000<br> SYS_mmap2(0xb7fd8000, 8192, 3, 2066,
3) \
\
= 0xb7fd8000<br> SYS_close(3) &nb \
sp;   \
; & \
nbsp; &nb \
sp;
= 0<br>
SYS_open("/usr/lib/libcrypto.so.0.9.7", 0,
00)   \
; \
= 3<br> SYS_read(3, "\177ELF\001\001\001",
512) &nbs \
p; \
= 512<br> SYS_fstat64(3, 0xbffff058, 0xb8000fd4, 28,
0xb800166c) &nb \
sp; = \
0<br> SYS_mmap2(0, 4096, 3, 34,
-1)   \
; & \
nbsp; \
= 0xb7fb6000<br> SYS_mmap2(0, 0x000fbe58, 5, 2050,
3) \
&n \
bsp; \
= 0xb7eba000<br> SYS_mmap2(0xb7fa1000, 73728, 3, 2066,
3) \
\
= 0xb7fa1000<br> SYS_mmap2(0xb7fb3000, 11864, 3, 50,
-1)   \
; \
= 0xb7fb3000<br> SYS_close(3) &nb \
sp;   \
; & \
nbsp; &nb \
sp;
= 0<br>
SYS_open("/usr/lib/libelf.so.1", 0,
00)   \
; \
= 3<br> SYS_read(3, "\177ELF\001\001\001",
512) &nbs \
p; \
= 512<br> SYS_fstat64(3, 0xbffff03c, 0xb8000fd4, 21,
0xb800166c) &nb \
sp; = \
0<br> SYS_mmap2(0, 71560, 5, 2050,
3) \
&n \
bsp; \
= 0xb7ea8000<br> SYS_mmap2(0xb7eb9000, 4096, 3, 2066,
3) \
\
= 0xb7eb9000<br> SYS_close(3) &nb \
sp;   \
; & \
nbsp; &nb \
sp;
= 0<br>
SYS_open("/lib/libc.so.6", 0,
00)   \
; & \
nbsp; \
= 3<br> SYS_read(3, "\177ELF\001\001\001",
512) &nbs \
p; \
= 512<br> SYS_fstat64(3, 0xbffff020, 0xb8000fd4, 15,
0xb800166c) &nb \
sp; = \
0<br> SYS_mmap2(0, 0x00115d2c, 5, 2050,
3) \
&n \
bsp; \
= 0xb7d92000<br> SYS_mmap2(0xb7ea2000, 16384, 3, 2066,
3) \
\
= 0xb7ea2000<br> SYS_mmap2(0xb7ea6000, 7468, 3, 50,
-1)   \
; & \
nbsp; = \
0xb7ea6000<br> SYS_close(3)   \
; & \
nbsp; &nb \
sp;   \
;
= 0<br>
SYS_open("/lib/libdl.so.2", 0,
00)   \
; & \
nbsp; \
= 3<br> SYS_read(3, "\177ELF\001\001\001",
512) &nbs \
p; \
= 512<br> SYS_fstat64(3, 0xbfffeee8, 0xb8000fd4, 16,
0xb800166c) &nb \
sp; = \
0<br> SYS_mmap2(0, 12392, 5, 2050,
3) \
&n \
bsp; \
= 0xb7d8e000<br> SYS_mmap2(0xb7d90000, 8192, 3, 2066,
3) \
\
= 0xb7d90000<br> SYS_close(3) &nb \
sp;   \
; & \
nbsp; &nb \
sp;
= 0<br>
SYS_mmap2(0, 4096, 3, 34,
-1)   \
; & \
nbsp; \
= 0xb7d8d000<br> SYS_mprotect(0xb7d90000, 4096, 1, 0xb7fb67d8,
0xb7fb67d8) \
= 0<br> SYS_mprotect(0xb7ea2000, 8192, 1, 0xb7fb6520,
0xb7fb6520) \
= 0<br> SYS_mprotect(0xb7fd8000, 4096, 1, 0xb8001c60,
0xb8001c60) \
= 0<br> SYS_mprotect(0xb8000000, 4096, 1, 0xb80011c0,
0xb80011c0) \
= 0<br> SYS_set_thread_area(0xbffff690, 0xb8000fd4, 243, 0,
0xb80011c0) \
= 0<br> SYS_munmap(0xb7fda000,
66718) &n \
bsp; &nbs \
p; \
= 0<br> SYS_open("/dev/urandom", 0,
027777774250) & \
nbsp; \
= 3<br> SYS_read(3, "\300\226\375\037",
4) \
&n \
bsp; \
= 4<br> SYS_close(3) \
&n \
bsp; &nbs \
p; \
\
= 0<br> SYS_umask(00)   \
; & \
nbsp; &nb \
sp;
= 022<br>
SYS_umask(022) \
&n \
bsp; &nbs \
p;
= 00<br>
SYS_getuid32(0xb7ea3ff4, 0xb7da7176, 0xb7ea3ff4, 3,
0xbffff954) \
= 0<br> SYS_gettimeofday(0xbffff7c8, 0, 0xbffff818, 3,
0xbffff954) \
= 0<br> SYS_clone(0x01200011, 0, 0, 0, 0xb7d8d908ltrace: dict.c:117:
dict_apply_to_all: Assertion `d' failed.<br>
Aborted</font></DEFANGED_div>
<DEFANGED_div> </DEFANGED_div>
<DEFANGED_div><font size="2">I have tried to compile it using enable-options:
--enable-clockctl and --enable-linuxcaps. But same results. It \
crashes.</font></DEFANGED_div> <DEFANGED_div> </DEFANGED_div>
<DEFANGED_div><font size="2">I have tried to run ntpd as other user with
privileges over used files, but it crashes:</font></DEFANGED_div>
<DEFANGED_div><a href=""><font size="1">ntp@gentoo</font></a><font size="1">
bin $ ltrace -S ./ntpd <br>
SYS_uname(0xbffff7bc)   \
; & \
nbsp; &nb \
sp;
= 0<br>
SYS_brk(NULL) & \
nbsp; &nb \
sp;   \
;
= 0x8123000<br>
SYS_access(0xb7ffbb40, 4, 0xb8000fd4, 0,
0xb7ffbb40) &nb \
sp; \
= -2<br> SYS_open("/etc/ld.so.cache", 0,
00)   \
; & \
nbsp; \
= 3<br> SYS_fstat64(3, 0xbffff0a8, 0xb8000fd4, 3,
0xb800146c) &nb \
sp; \
= 0<br> SYS_mmap2(0, 66718, 1, 2,
3) \
&n \
bsp; \
= 0xb7fda000<br> SYS_close(3) &nb \
sp;   \
; & \
nbsp; &nb \
sp;
= 0<br>
SYS_open("/lib/libm.so.6", 0,
00)   \
; & \
nbsp; \
= 3<br> SYS_read(3, "\177ELF\001\001\001",
512) &nbs \
p; \
= 512<br> SYS_fstat64(3, 0xbffff134, 0xb8000fd4, 15,
0xb800166c) &nb \
sp; = \
0<br> SYS_mmap2(0, 139424, 5, 2050,
3) \
&n \
bsp; \
= 0xb7fb7000<br> SYS_mmap2(0xb7fd8000, 8192, 3, 2066,
3) \
\
= 0xb7fd8000<br> SYS_close(3) &nb \
sp;   \
; & \
nbsp; &nb \
sp;
= 0<br>
SYS_open("/usr/lib/libcrypto.so.0.9.7", 0,
00)   \
; \
= 3<br> SYS_read(3, "\177ELF\001\001\001",
512) &nbs \
p; \
= 512<br> SYS_fstat64(3, 0xbffff118, 0xb8000fd4, 28,
0xb800166c) &nb \
sp; = \
0<br> SYS_mmap2(0, 4096, 3, 34,
-1)   \
; & \
nbsp; \
= 0xb7fb6000<br> SYS_mmap2(0, 0x000fbe58, 5, 2050,
3) \
&n \
bsp; \
= 0xb7eba000<br> SYS_mmap2(0xb7fa1000, 73728, 3, 2066,
3) \
\
= 0xb7fa1000<br> SYS_mmap2(0xb7fb3000, 11864, 3, 50,
-1)   \
; \
= 0xb7fb3000<br> SYS_close(3) &nb \
sp;   \
; & \
nbsp; &nb \
sp;
= 0<br>
SYS_open("/usr/lib/libelf.so.1", 0,
00)   \
; \
= 3<br> SYS_read(3, "\177ELF\001\001\001",
512) &nbs \
p; \
= 512<br> SYS_fstat64(3, 0xbffff0fc, 0xb8000fd4, 21,
0xb800166c) &nb \
sp; = \
0<br> SYS_mmap2(0, 71560, 5, 2050,
3) \
&n \
bsp; \
= 0xb7ea8000<br> SYS_mmap2(0xb7eb9000, 4096, 3, 2066,
3) \
\
= 0xb7eb9000<br> SYS_close(3) &nb \
sp;   \
; & \
nbsp; &nb \
sp;
= 0<br>
SYS_open("/lib/libc.so.6", 0,
00)   \
; & \
nbsp; \
= 3<br> SYS_read(3, "\177ELF\001\001\001",
512) &nbs \
p; \
= 512<br> SYS_fstat64(3, 0xbffff0e0, 0xb8000fd4, 15,
0xb800166c) &nb \
sp; = \
0<br> SYS_mmap2(0, 0x00115d2c, 5, 2050,
3) \
&n \
bsp; \
= 0xb7d92000<br> SYS_mmap2(0xb7ea2000, 16384, 3, 2066,
3) \
\
= 0xb7ea2000<br> SYS_mmap2(0xb7ea6000, 7468, 3, 50,
-1)   \
; & \
nbsp; = \
0xb7ea6000<br> SYS_close(3)   \
; & \
nbsp; &nb \
sp;   \
;
= 0<br>
SYS_open("/lib/libdl.so.2", 0,
00)   \
; & \
nbsp; \
= 3<br> SYS_read(3, "\177ELF\001\001\001",
512) &nbs \
p; \
= 512<br> SYS_fstat64(3, 0xbfffefa8, 0xb8000fd4, 16,
0xb800166c) &nb \
sp; = \
0<br> SYS_mmap2(0, 12392, 5, 2050,
3) \
&n \
bsp; \
= 0xb7d8e000<br> SYS_mmap2(0xb7d90000, 8192, 3, 2066,
3) \
\
= 0xb7d90000<br> SYS_close(3) &nb \
sp;   \
; & \
nbsp; &nb \
sp;
= 0<br>
SYS_mmap2(0, 4096, 3, 34,
-1)   \
; & \
nbsp; \
= 0xb7d8d000<br> SYS_mprotect(0xb7d90000, 4096, 1, 0xb7fb67d8,
0xb7fb67d8) \
= 0<br> SYS_mprotect(0xb7ea2000, 8192, 1, 0xb7fb6520,
0xb7fb6520) \
= 0<br> SYS_mprotect(0xb7fd8000, 4096, 1, 0xb8001c60,
0xb8001c60) \
= 0<br> SYS_mprotect(0xb8000000, 4096, 1, 0xb80011c0,
0xb80011c0) \
= 0<br> SYS_set_thread_area(0xbffff750, 0xb8000fd4, 243, 0,
0xb80011c0) \
= 0<br> SYS_munmap(0xb7fda000,
66718) &n \
bsp; &nbs \
p; \
= 0<br> SYS_open("/dev/urandom", 0,
027777774550) & \
nbsp; \
= 3<br> SYS_read(3, "</font><a href=""><font size="1">Yx@V</font></a><font
size="1">",
4) \
&n \
bsp; &nbs \
p; \
= 4<br> SYS_close(3) \
&n \
bsp; &nbs \
p; \
\
= 0<br> SYS_umask(00)   \
; & \
nbsp; &nb \
sp;
= 022<br>
SYS_umask(022) \
&n \
bsp; &nbs \
p;
= 00<br>
SYS_getuid32(0xb7ea3ff4, 0xb7da7176, 0xb7ea3ff4, 1,
0xbffffa14) \
= 123<br> SYS_brk(NULL) &nb \
sp;   \
; & \
nbsp; &nb \
sp; = \
0x8123000<br> SYS_brk(0x8144000) \
&n \
bsp; &nbs \
p;
= 0x8144000<br>
SYS_time(0xbffff16c, 0, 0xb7ea3ff4, 0xbffff16c,
0x08123008) \
= 0x42bc1f18<br> SYS_open("/etc/localtime", 0,
0666) &nb \
sp;   \
; \
= 3<br> SYS_fstat64(3, 0xbfffefec, 0xb7ea3ff4, 0,
0xb7e95db8) &nb \
sp; \
= 0<br> SYS_fstat64(3, 0xbfffeeb0, 0xb7ea3ff4, 0x081251a0,
8192) \
= 0<br> SYS_mmap2(0, 4096, 3, 34,
-1)   \
; & \
nbsp; \
= 0xb7fea000<br> SYS_read(3, "TZif",
4096) &nb \
sp;   \
; \
= 700<br> SYS_close(3) &nbs \
p; \
&n \
bsp; &nbs \
p;
= 0<br>
SYS_munmap(0xb7fea000,
4096) &nb \
sp;   \
; \
= 0<br> SYS_open("/etc/localtime", 0,
0666) &nb \
sp;   \
; \
= 3<br> SYS_fstat64(3, 0xbfffeed0, 0xb7ea3ff4, 0,
0xb7e95db8) &nb \
sp; \
= 0<br> SYS_close(3) \
&n \
bsp; &nbs \
p; \
\
= 0<br> SYS_open("/etc/localtime", 0,
0666) &nb \
sp;   \
; \
= 3<br> SYS_fstat64(3, 0xbfffed74, 0xb7ea3ff4, 0,
0xb7e95db8) &nb \
sp; \
= 0<br> SYS_close(3) \
&n \
bsp; &nbs \
p; \
\
= 0<br> SYS_open("/etc/localtime", 0,
0666) &nb \
sp;   \
; \
= 3<br> SYS_fstat64(3, 0xbfffed74, 0xb7ea3ff4, 0,
0xb7e95db8) &nb \
sp; \
= 0<br> SYS_close(3) \
&n \
bsp; &nbs \
p; \
\
= 0<br> SYS_rt_sigaction(13, 0xbffff07c, 0xbfffefec, 8,
0xb7ea3ff4) \
= 0<br> SYS_socketcall(1, 0xbffff108, 0xb7ea3ff4, 0,
0xbffff1c8) \
= 3<br> SYS_fcntl64(3, 2, 1, 1,
0xb7ea3ff4) &nb \
sp;   \
; \
= 0<br> SYS_socketcall(3, 0xbffff108, 0xb7ea3ff4, 0,
-32) &nbs \
p; \
= 0<br> SYS_socketcall(9, 0xbffff138, 0xb7ea3ff4, 0,
0xbffff1c8) \
= 64<br> SYS_rt_sigaction(13, 0xbffff07c, 0, 8,
0xb7ea3ff4) &nb \
sp; \
= 0<br> SYS_exit_group(1 <unfinished ...><br>
+++ exited (status 1) +++</font></DEFANGED_div>
<DEFANGED_div> </DEFANGED_div>
<DEFANGED_div><font size="2">Most curiosly that ntpd syntax don't show me -u
or -i options to use:</font></DEFANGED_div>
<DEFANGED_div> </DEFANGED_div>
<DEFANGED_div><font size="2">usage: bin/ntpd [ -abdgmnx ] [ -c config_file ] [
-e e_delay ]<br>
\
[ -f freq_file ] [ -k key_file ] [ -l log_file ]<br> \
\
[ -p pid_file ] [ -r broad_delay ] [ -s statdir ]<br> \
\
[ -t trust_key ] [ -v sys_var ] [ -V default_sysvar ]<br> \
\
[ -P fixed_process_priority ]</font></DEFANGED_div> \
</font></font></tt></DEFANGED_div> <tt><font size="2"><font size="2"><font size="2">
<DEFANGED_div> </DEFANGED_div>
<DEFANGED_div>Any suggestion about? Thanks a lot!</DEFANGED_div>
<DEFANGED_div> </DEFANGED_div>
<DEFANGED_div><br>
My best wishes,</DEFANGED_div>
</font></font></font></tt></DEFANGED_div>
<tt><font size="2"><font size="2"></font></font></tt>
<DEFANGED_div><tt><font size="2"><font size="2"><br>
--------------------------------------------------<br>
Resurrección Mazo González<br>
<a href="mailto:rmazgon@canarias.org">rmazgon@canarias.org</a><br>
--------------------------------------------------<br>
Este correo electrónico y, en su caso, cualquier fichero anexo al
mismo, contiene información de carácter confidencial exclusivamente
dirigida a su destinatario o destinatarios. Queda prohibida su
divulgación, copia o distribución a terceros sin la previa \
autorización escrita. En el caso de haber recibido este correo \
electrónico por error, se ruega notifíquese inmediatamente esta \
circunstancia mediante reenvío a la dirección electrónica del \
remitente.<br> </font></font></tt></DEFANGED_div>
</blockquote>
<tt><br>
</tt>
</body>
</html>
_______________________________________________
bugs mailing list
bugs@lists.ntp.isc.org
https://lists.ntp.isc.org/mailman/listinfo/bugs
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic