Packet Storm - Information Security News, Files, Tools, Exploits, Advisories and Whitepapers http://packetstormsecurity.org/ en-us Sun, 27 May 2012 23:05:15 GMT 144400 http://packetstormsecurity.org/ http://www.google-analytics.com/__utm.gif?utmwv=1.3&utmn=1337965073&utmcs=ISO-8859-1&utmsr=31337x31337&utmsc=32-bit&utmul=en-us&utmje=0&utmfl=-&utmcn=1&utmdt=Files%u2248%20Packet%20Storm&utmhn=packetstormsecurity.org&utmr=-&utmp=%2F0208-exploits%2FGOBBLES-own-ipppd.c%2F&utmac=UA-18885198-1&utmcc=__utma%3D32867617.1337965073.1338159915.1338159915.1338159915.1%3B%2B__utmz%3D32867617.1338159915.1.1.utmccn%3D(direct)%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none) http://packetstormsecurity.org/files/26531/GOBBLES-own-ipppd.c http://packetstormsecurity.org/files/26531/GOBBLES-own-ipppd.c http://packetstormsecurity.org/files/26531/GOBBLES-own-ipppd.c.html Sat, 10 Aug 2002 23:48:29 GMT Gobbles exploit for ipppd which is part of the isdn4linux-utils package and is part of the default install of many linux distributions. Under Suse 8.0, ipppd is installed suid root but can only be run by users in the group "dialout". The exploit works on a syslog(3) format string problem: syslog(LOG_NOTICE,devstr). This code is normally only reached with a valid device string but if you feed ipppd a devicename that is >= 256 bytes it will merrily proceed to log this string using the faulty syslog(3) call. Subsequently handing over root access to the machine.