The scanning of the Debian source archive for security bugs has begun.

I've wrote about this previously and there was some interest in how it worked, so I've put up a simple webpage describing the process.

There are a lot of results to go through, but so far I've managed to find one local root exploit and many many many trivial problems.

Sample bugs:

• came: buffer overflow in handling $HOME
• aatv: Buffer overflow in handling environmental variables.

Unfortunately my usertags seem to be broken. This was working a day or two ago. Not sure if I fucked up or if the BTS is broken ..?

Tags: shellcode, sourcescan | No comments