Date: Tue, 31 Jan 2012 17:03:22 +0100 From: Oliver Pinter <oliver.pntr@gmail.com> To: freebsd-security@freebsd.org Subject: Fwd: [Full-disclosure] Advisory: sudo 1.8 Format String Vulnerability Message-ID: <CAPjTQNFPRW7nzDRAG2k1uqeRLT1vcbe4ezPQKxhrcc67U4%2B_Mg@mail.gmail.com> In-Reply-To: <CADcgPfLjNErvG4bZ9nzrwD8WG%2B%2BSKQYOvPxi16YWvqMyR3k5fw@mail.gmail.com> References: <4F26A18A.3020402@phenoelit.de> <CADcgPfLjNErvG4bZ9nzrwD8WG%2B%2BSKQYOvPxi16YWvqMyR3k5fw@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--20cf303a320b323bfc04b7d51abb Content-Type: text/plain; charset=ISO-8859-1 ---------- Forwarded message ---------- From: joernchen of Phenoelit <joernchen@phenoelit.de> Date: Mon, 30 Jan 2012 14:56:26 +0100 Subject: [Full-disclosure] Advisory: sudo 1.8 Format String Vulnerability To: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com Hi, FYI, see attached. cheers, joernchen -- joernchen ~ Phenoelit <joernchen@phenoelit.de> ~ C776 3F67 7B95 03BF 5344 http://www.phenoelit.de ~ A46A 7199 8B7B 756A F5AC --20cf303a320b323bfc04b7d51abb Content-Type: text/plain; charset=US-ASCII; name="advisory_sudo.txt" Content-Disposition: attachment; filename="advisory_sudo.txt" Content-Transfer-Encoding: base64 X-Attachment-Id: 68833241ebaac8e3_0.1 UGhlbm9lbGl0IEFkdmlzb3J5IDx3aXItaGFiZW4tYXVjaC1tYWwtd2FzLWdlZnVuZGVuICMwODE1 ICstLSsrPgoKWyBBdXRob3JzIF0KICAgICAgICBqb2VybmNoZW4gICAgICAgPGpvZXJuY2hlbiAo KSBwaGVub2VsaXQgZGU+CgogICAgICAgIFBoZW5vZWxpdCBHcm91cCAoaHR0cDovL3d3dy5waGVu b2VsaXQuZGUpCgpbIEFmZmVjdGVkIFByb2R1Y3RzIF0KICAgICAgICBzdWRvIDEuOC4wIC0gMS44 LjNwMSAoaHR0cDovL3N1ZG8ud3MpCgpbIFZlbmRvciBjb21tdW5pY2F0aW9uIF0KICAgICAgICAy MDEyLTAxLTI0IFNlbmQgdnVsbmVyYWJpbGl0eSBkZXRhaWxzIHRvIHN1ZG8gbWFpbnRhaW5lcgog ICAgICAgIDIwMTItMDEtMjQgTWFpbnRhaW5lciBpcyBlbWJhcnJhc2VkCiAgICAgICAgMjAxMi0w MS0yNyBBc2tpbmcgbWFpbnRhaW5lciBob3cgdGhlIGZpeGluZyBnb2VzCiAgICAgICAgMjAxMi0w MS0yNyBNYWludGFpbmVyIHJlc3BvbmRzIHdpdGggYSBwYXRjaCBhbmQgYSByZWxlYXNlIGRhdGUK ICAgICAgICAgICAgICAgICAgIG9mIDIwMTItMDEtMzAgZm9yIHRoZSBwYXRjaGVkIHN1ZG8gYW5k IGFkdmlzb3J5CiAgICAgICAgMjAxMi0wMS0zMCBSZWxlYXNlIG9mIHRoaXMgYWR2aXNvcnkKClsg RGVzY3JpcHRpb24gXQoKICAgICAgICBPYnNlcnZlIHNyYy9zdWRvLmM6Cgp2b2lkCnN1ZG9fZGVi dWcoaW50IGxldmVsLCBjb25zdCBjaGFyICpmbXQsIC4uLikKewogICAgdmFfbGlzdCBhcDsKICAg IGNoYXIgKmZtdDI7CgogICAgaWYgKGxldmVsID4gZGVidWdfbGV2ZWwpCiAgICAgICAgcmV0dXJu OwoKICAgIC8qIEJhY2tldCBmbXQgd2l0aCBwcm9ncmFtIG5hbWUgYW5kIGEgbmV3bGluZSB0byBt YWtlIGl0IGEgc2luZ2xlIAogICAgd3JpdGUgKi8KICAgIGVhc3ByaW50ZigmZm10MiwgIiVzOiAl c1xuIiwgZ2V0cHJvZ25hbWUoKSwgZm10KTsKICAgIHZhX3N0YXJ0KGFwLCBmbXQpOwogICAgdmZw cmludGYoc3RkZXJyLCBmbXQyLCBhcCk7CiAgICB2YV9lbmQoYXApOwogICAgZWZyZWUoZm10Mik7 Cn0KCiAgICAgICAgSGVyZSBnZXRwcm9nbmFtZSgpIGlzIGFyZ3ZbMF0gYW5kIGJ5IHRoaXMgdXNl ciBjb250cm9sbGVkLiBTbyAKICAgICAgICBhcmd2WzBdIGdvZXMgdG8gZm10MiB3aGljaCB0aGVu IGdldHMgdmZwcmludGYoKWVkIHRvIHN0ZGVyci4gVGhlCiAgICAgICAgcmVzdWx0IGlzIGEgRm9y bWF0IFN0cmluZyB2dWxuZXJhYmlsaXR5LiAgIAoKWyBFeGFtcGxlIF0KICAgICAgICAvdG1wICQg bG4gLXMgL3Vzci9iaW4vc3VkbyAlbgogICAgICAgIC90bXAgJCAuLyVuIC1EOQogICAgICAgICoq KiAlbiBpbiB3cml0YWJsZSBzZWdtZW50IGRldGVjdGVkICoqKgogICAgICAgIEFib3J0ZWQKICAg ICAgICAvdG1wICQKCiAgICAgICBBIG5vdGUgcmVnYXJkaW5nIGV4cGxvaXRhYmlsaXR5OiBUaGUg YWJvdmUgZXhhbXBsZSBzaG93cyB0aGUgcmVzdWx0CiAgICAgICBvZiBGT1JUSUZZX1NPVVJDRSB3 aGljaCBtYWtlcyBleHBsb3RpdGF0aW9uIHBhaW5mdWwgYnV0IG5vdCAKICAgICAgIGltcG9zc2li bGUgKHNlZSBbMF0pLiBXaXRob3V0IEZPUlRJRllfU09VUkNFIHRoZSBleHBsb2l0IGlzIHN0cmFp Z2h0CiAgICAgICBmb3J3YXJkOgogICAgICAgICAxLiBVc2UgZm9ybWF0c3RyaW5nIHRvIG92ZXJ3 cml0ZSB0aGUgc2V0dWlkKCkgY2FsbCB3aXRoIHNldGdpZCgpCiAgICAgICAgIDIuIFRyaWdnZXIg d2l0aCBmb3JtYXRzdHJpbmcgLUQ5IAogICAgICAgICAzLiBNYWtlIHVzZSBvZiBTVURPX0FTS1BB U1MgYW5kIGhhdmUgc2hlbGxjb2RlIGluIGFza3Bhc3Mgc2NyaXB0CiAgICAgICAgIDQuIEFzIGFz a3Bhc3Mgd2lsbCBiZSBjYWxsZWQgYWZ0ZXIgdGhlIGZvcm1hdHN0cmluZyBoYXMgCiAgICAgICAg ICAgIG92ZXJ3cml0dGVuIHNldHVpZCgpIHRoZSBhc2tlcGFzcyBzY3JpcHQgd2lsbCBydW4gd2l0 aCB1aWQgMAogICAgICAgICA1LiBFbmpveSB0aGUgcm9vdHNoZWxsCiAKWyBTb2x1dGlvbiBdCiAg ICAgICAgVXBkYXRlIHRvIHZlcnNpb24gMS44LjMucDIgCgpbIFJlZmVyZW5jZXMgXQogICAgICAg IFswXSBodHRwOi8vd3d3LnBocmFjay5vcmcvaXNzdWVzLmh0bWw/aXNzdWU9NjcmaWQ9OQoKWyBl bmQgb2YgZmlsZSBdCg== --20cf303a320b323bfc04b7d51abb--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAPjTQNFPRW7nzDRAG2k1uqeRLT1vcbe4ezPQKxhrcc67U4%2B_Mg>