[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Re: [CVE-2020-28018] Use-After-Free on Exim Question
From:       Qualys Security Advisory <qsa () qualys ! com>
Date:       2021-05-12 23:46:13
Message-ID: 20210512234414.GB1175 () localhost ! localdomain
[Download RAW message or body]

Hi,

On Wed, May 12, 2021 at 02:46:31PM +0000, harris.johnson.x wrote:
> R u guys using any specific technique to groom the heap / get the
> chunk returned by store_get() on that struct?

We first send a large EHLO command to make sure that the next allocation
will overwrite the freed struct gstring, and then we send the MAIL FROM
command (with an AUTH parameter) to actually overwrite the freed struct
gstring (with arbitrary characters).

Hopefully this helps! With best regards,

--
the Qualys Security Advisory team


[https://d1dejaj6dcqv24.cloudfront.net/asset/image/email-banner-384-2x.png]<https://www.qualys.com/email-banner>




This message may contain confidential and privileged information. If it has been sent to you in \
error, please reply to advise the sender of the error and then immediately delete it. If you \
are not the intended recipient, do not read, copy, disclose or otherwise use this message. The \
sender disclaims any liability for such unauthorized use. NOTE that all incoming emails sent to \
Qualys email accounts will be archived and may be scanned by us and/or by external service \
providers to detect and prevent threats to our systems, investigate illegal or inappropriate \
behavior, and/or eliminate unsolicited promotional emails ("spam"). If you have any concerns \
about this process, please contact us.


[prev in list] [next in list] [prev in thread] [next in thread]