Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Full-disclosure] mydns-1.1.0 remote heap overflow

from [mu-b] Network Security [Permanent Link]
Subject: [Full-disclosure] mydns-1.1.0 remote heap overflow
Date: Fri, 27 Apr 2007 09:45:25 +0100 
The attached PoC causes a remote heap smash in mydns 1.1.0, the bug is found
within the dynamic update code (update.c). Exploitation requires update privs
(which tends not to matter too much if you know an IP address with
privileges to do so), also allow-update = yes must be set in /etc/mydns.conf.
The attached patch also fixes a stack based off-by-one overflow in update.c.

Example :-
0xb7f27410 in __kernel_vsyscall
    ()
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x0805d0e2 in ?? ()
(gdb) x/i $eip
0x805d0e2 <strcpy@plt+73534>:   rep movsb %ds:(%esi),%es:(%edi)

PoC: http://www.digit-labs.org/files/exploits/mydns-rr-smash.c
Patch: http://www.digit-labs.org/files/patches/mydns-update.c.diff
-- 
mu-b
(mu-b@digit-labs.org)

  "Only a few people will follow the proof. Whoever does will
     spend the rest of his life convincing people it is correct."
        - Anonymous, "P ?= NP"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [Full-disclosure] mydns-1.1.0 remote heap overflow, mu-b <=
Previous by Date:  Re: [Full-disclosure] FW: Steganos Encrypted Safe NOT so safe, Dan Bambach
Next by Date:  [Full-disclosure] Buying zeroday vulnerabilities, 0buy
Previous by Thread:  [Full-disclosure] iDefense Security Advisory 04.26.07: Novell eDirectory NCP Fragment Denial of Service Vulnerability, iDefense Labs
Next by Thread:  [Full-disclosure] Buying zeroday vulnerabilities, 0buy
Indexes:  [Date] [Thread] [Top] [All Lists]