Entries tagged shellcode

The scanning of the Debian source archive for security bugs has begun.

I've wrote about this previously and there was some interest in how it worked, so I've put up a simple webpage describing the process.

There are a lot of results to go through, but so far I've managed to find one local root exploit and many many many trivial problems.

Sample bugs:

• came: buffer overflow in handling $HOME
• aatv: Buffer overflow in handling environmental variables.

Unfortunately my usertags seem to be broken. This was working a day or two ago. Not sure if I fucked up or if the BTS is broken ..?

Tags: shellcode, sourcescan | No comments

Three, count them, three local root exploits discovered so far via the source scan of the Debian archive. More to follow.

• DSA-1326-1: fireflier-server
• DSA-1327-1: gsambad
• DSA-1328-1: unicon-imc2
  • This is an interesting one because the library itself isn't setuid, but it is linked to by the setuid application zhcon.
  • Which makes this exploit an instant root attack.

Right now my biggest irritation is the amount of time it takes to report bugs in packages which don't have security issues - just bad coding. It takes me a fair while to do it, since I either have to install the package and use "reportbug", or lookup version numbers and submit manually. I should think of a better way of doing it.

Tags: advisories, doing-stuff, shellcode, sourcescan | No comments