Re: Kernel exploit in brk() function.

Christophe Devine <[email protected]> writes:

G> Ian Molton <[email protected]> wrote:
>
>> > Seems this is how the debian servers got rooted last week.  Fixed in
>> > 2.4.23. 
>
>> Impressive. fixed before release of a broken version, then discovered ;-)
>
> The team that created the exploit just released the source, which is an
> impressive piece of work, and actually works. I tested it on Debian 3.0:
>
> bash-2.05a$ gcc -static hatorihanzo.c
> bash-2.05a$ ./a.out
> sh-2.05a# id
> uid=0(root) gid=0(root)
>
> You can download the code at http://www.cr0.net:8040/misc/hatorihanzo.c

billyoc@dps11 billyoc$ gcc -static hatorihanzo.c 
hatorihanzo.c: In function `ldt':
hatorihanzo.c:201: error: storage size of `l' isn't known
-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page