Exploit Sendmail 8.11/8.12 Debugger - Arbitrary Code Execution (3)

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
21062
Проверка EDB
  1. Пройдено
Автор
LUCIAN HUDIN
Тип уязвимости
LOCAL
Платформа
LINUX
CVE
cve-2001-0653
Дата публикации
2001-08-17
Код:
source: https://www.securityfocus.com/bid/3163/info
  
An input validation error exists in Sendmail's debugging functionality.
  
The problem is the result of the use of signed integers in the program's tTflag() function, which is responsible for processing arguments supplied from the command line with the '-d' switch and writing the values to it's internal "trace vector." The vulnerability exists because it is possible to cause a signed integer overflow by supplying a large numeric value for the 'category' part of the debugger arguments. The numeric value is used as an index for the trace vector, and can therefore be used to write within a certain range of proces memory if a negative value is given.
  
Because the '-d' command-line switch is processed before the program drops its elevated privileges, this could lead to a full system compromise. This vulnerability has been successfully exploited in a laboratory environment.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21062.tar.gz
 
Источник
www.exploit-db.com

Похожие темы