[Full-disclosure] Insect Pro - Advisory 2011 0428 - Zero Day - Heap Buffer Overflow in xMatters APClient
cal at foxwhisper.co.uk
Sun May 1 13:11:47 BST 2011
Juan, perhaps you could contribute further POC code which shows how far you
can get with this exp? Plus. xMatters only seems to be used by high level
enterprise users in big corporations, and I can think of 1 other person on
this list that matches this criteria, so the chances of finding someone here
to do this, are slim.
On Fri, Apr 29, 2011 at 4:43 AM, Mario Vilas <mvilas at gmail.com> wrote:
> Precisely. The poc triggers the bug by passing a very long command line
> argument, so it's assumed the attacker already has executed code. The only
> way this is exploitable is if the binary has suid (then the attacker can
> elevate privileges) or the command can be executed remotely (and the
> attacker additionaly cannot execute any other commands, but can mysteriously
> control the arguments). Unless either scenario is researched (and nothing in
> the advisory tells me so) I call bullshit.
> On Thu, Apr 28, 2011 at 6:09 PM, <Valdis.Kletnieks at vt.edu> wrote:
>> On Thu, 28 Apr 2011 14:40:22 -0300, Mario Vilas said:
>> > Is the suid bit set on that binary? Otherwise, unless I'm missing
>> > it doesn't seem to be exploitable by an attacker...
>> Who cares? You got code executed on the remote box, that's the *hard*
>> Use that to inject a callback shell or something, use *that* to get
>> yourself a shell
>> prompt. At that point, download something else that exploits you to root
>> - if
>> you even *need* to, as quite often the Good Stuff is readable by non-root
> “There's a reason we separate military and the police: one fights the enemy
> of the state, the other serves and protects the people. When the military
> becomes both, then the enemies of the state tend to become the people.”
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
-------------- next part --------------
An HTML attachment was scrubbed...
Full-Disclosure is hosted and sponsored by Secunia.