Thread View: pl.comp.security
2 messages
2 total messages
Started by Zbigniew Zych
Sat, 19 Apr 1997 21:10
perl security
Author: Zbigniew Zych
Date: Sat, 19 Apr 1997 21:10
Date: Sat, 19 Apr 1997 21:10
42 lines
2160 bytes
2160 bytes
Przyszło dziś emailem: ********* >From linux-alert-request@redhat.com Sat Apr 19 18:49:46 1997 X-Sender: webmaster@perl.org (Unverified) X-Mailer: Windows Eudora Pro Version 3.0.1 (32) Date: Fri, 18 Apr 1997 21:09:01 -0700 To: linux-security@redhat.com From: Webmaster <webmaster@perl.org> Cc: redhat-announce-list@redhat.com Subject: [linux-alert] Re: [linux-security] SECURITY: vulnerability in sperl At 10:15 AM 4/18/97 -0400, Erik Troan wrote: > >Red Hat Software has been notified of a critical security problem (a buffer >overrun) in /usr/bin/sperl*. As no official fix for this problem exists, >we recommend turning off the setuid bit on /usr/bin/sperl*. As far as >we know, this problem affects all platforms and all versions. > >As soon as a fix is available we will release a new version of the perl >package and announce it here. If no fix seems forthcoming, we will issue >a new package w/o the setuid bit enabled on /usr/sbin/sperl. A patch for 5.003_97f has appeared on the Perl5-Porters list. The entire codebase is being examined line by line to find any other such conditions. >You can disable the exploits for this bug with the following command: > > chmod u-s /usr/bin/sperl* Perl 5.003_97g was released tonight. It should fix that bug. Any other overflow problems will be caught and killed before the 5.004 release. Alan Olsen "Mi Tio es infermo, pero la carretera es verde!" Webmaster The Perl Institute webmaster@perl.org ********* Zbigniew Zych -- http://onet.pl/~zych/
Re: perl security
Author: Krzysztof G. Baranowski
Date: Sun, 20 Apr 1997 08:49
Date: Sun, 20 Apr 1997 08:49
30 lines
1772 bytes
1772 bytes
Zbigniew Zych <zych@bit.onet.pl> wrote in article <5jbcc2$em4$1@bit.onet.pl>... > Przyszło dziś emailem: [wyciete...] A cos takiego pojawilo sie na liscie Bugtraq: ---------- > To: BUGTRAQ@NETSPACE.ORG > Subject: Buffer overflow in sperl5.003 > Date: 17 kwietnia 1997 23:11 > > > Its came to my attention that there is a buffer overflow bug in > sperl5.003 that will allow local users gain root access, if SUID root. > The exploit and bug was made and brought to my attention by Willy Tarreau. > Attached is the source for the exploit. Since it requires some work to > be done to the compiled exploit (Stripping of 5 byte at the begining and > end of the binary), the precompiled Linux x86 exploit can be found at ---------- [adres z wiadomych wzgledow wyciety] I ciag dalszy z innego listu: ---------- >Note that the exploit tries offsets of 1170 to 1240. Debian Linux with >sperl5.00307 requires a value of 1169 (and is vulnerable). >David. --------- Kris -- Krzysztof G. Baranowski - Prezes Klubu Nieszkodliwych Manjakow "Invent something idiot-proof, and they will invent a better idiot" http://www.rubikon.net.pl/~celestyn/maniak/
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads