[VulnDiscuss] Re: Followup to Gobbles post

I don't know if Gobbles' post is a hoax.
All I can tell is that I've tested this fonction (but with an mp3 doing an "ls -rl") and with mpg123-0.59r and it works... quite anoying.
If you want this little mp3 (3ko = header + shellcode), I can email it to you. I've made a little perl script to check mp3 files. If anoyne is interested, mail me or look at
 http://doff.no-ip.org/   choose the "security" menu (don't miss the bottom of the page).
Cheers.
David

> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Some of you have written in wondering if the Gobbles post was a hoax or
> not.
> 
> Skipping past all the RIAA stuff (I can't exactly confirm any of that),
> there is still the issue of a buffer overflow in mpg123 version 0.59s.
> That *is* real, and so is the exploit that is attached (which, if
> successful in exploitation, will run 'rm -rf ~').
> 
> So yes, there is a mpg123 vulnerability in the latest development version
> (which some linux distros ship).  The latest stable version (0.59r) seems
> to be OK for the moment.
> 
> As for the 'hydra' (Swordfish, anyone?), RIAA involvement, and massive P2P
> neworking compromises, well, that's for you to determine.
> 
> Your loving VulnWatchdog,
> - - rain forest puppy
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Comment: Public key at http://www.wiretrip.net/rfp/gpg-key.txt
> 
> iD8DBQE+JZM08z6qql3x7WgRAsUEAJ0QgAgcMMZcLrmk901MwCh4r3aT5QCg11uT
> 8IM88jjj3fAYz6LL7i6Lix4=
> =QL6U
> -----END PGP SIGNATURE-----
> 
> 
> 
-------------
SPECIAL ADSL 
L'ADSL à partir de 15,95 EUR/mois et le modem ADSL offert ?  C'est en exclusivité chez Tiscali !
Pour profiter de cette offre, cliquez ici: http://register.tiscali.fr/adsl/
Offre soumise à conditions.