The debian-private mailing list leak, part 1. Volunteers have complained about Blackmail. Lynchings. Character assassination. Defamation. Cyberbullying. Volunteers who gave many years of their lives are picked out at random for cruel social experiments. The former DPL's girlfriend Molly de Blanc is given volunteers to experiment on for her crazy talks. These volunteers never consented to be used like lab rats. We don't either. debian-private can no longer be a safe space for the cabal. Let these monsters have nowhere to hide. Volunteers are not disposable. We stand with the victims.
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: FWD: Buffer overflow in sperl5.003

It's listed in http://cgi.debian.org/www-master/debian.org/sec.html now.

Joey Hess wrote:
> 
> Debian's perl-suid is vunderable. I've filed a bug against it, but I don't see
> any info about this problem on the security page on the web site yet.
> 
> -----Forwarded message from Murphy <jtmurphy@CRAY1.ECST.CSUCHICO.EDU>-----
> 
> Return-Path: <owner-bugtraq@NETSPACE.ORG>
> Received: from brimstone.netspace.org ([128.148.157.143]) by kite.ml.org
>          with esmtp id m0wI1gM-000Cn7C
>         (Debian Smail-3.2 1996-Jul-4 #2); Thu, 17 Apr 1997 20:37:22 -0400 (EDT)
> Received: from netspace.org ([128.148.157.6]) by brimstone.netspace.org with ESMTP id <36547-17683>; Thu, 17 Apr 1997 20:01:47 -0400
> Received: from NETSPACE.ORG by NETSPACE.ORG (LISTSERV-TCP/IP release 1.8c) with
>           spool id 3425942 for BUGTRAQ@NETSPACE.ORG; Thu, 17 Apr 1997 19:52:48
>           -0400
> Received: from brimstone.netspace.org (brimstone [128.148.157.143]) by
>           netspace.org (8.8.5/8.8.2) with ESMTP id TAA27468 for
>           <BUGTRAQ@netspace.org>; Thu, 17 Apr 1997 19:40:22 -0400
> Received: from netspace.org ([128.148.157.6]) by brimstone.netspace.org with
>           ESMTP id <32887-17680>; Thu, 17 Apr 1997 19:42:56 -0400
> Approved-By: aleph1@UNDERGROUND.ORG
> Received: from cray1.ecst.csuchico.edu (qmailr@cray1.ecst.csuchico.edu
>           [132.241.3.141]) by netspace.org (8.8.5/8.8.2) with SMTP id TAA22045
>           for <BUGTRAQ@NETSPACE.ORG>; Thu, 17 Apr 1997 19:10:49 -0400
> Received: (qmail 24683 invoked by uid 516); 17 Apr 1997 21:11:09 -0000
> MIME-Version: 1.0
> Content-Type: MULTIPART/MIXED; BOUNDARY="-242971389-615984271-861311469=:24662"
> Message-ID: <Pine.LNX.3.96.970417140348.24662A-101000@cray1.ecst.csuchico.edu>
> Date:   Thu, 17 Apr 1997 14:11:09 -0700
> Reply-To: Murphy <jtmurphy@CRAY1.ECST.CSUCHICO.EDU>
> Sender: Bugtraq List <BUGTRAQ@NETSPACE.ORG>
> From:   Murphy <jtmurphy@CRAY1.ECST.CSUCHICO.EDU>
> Subject:      Buffer overflow in sperl5.003
> To:     BUGTRAQ@NETSPACE.ORG
> 
>   This message is in MIME format.  The first part should be readable text,
>   while the remaining parts are likely unreadable without MIME-aware tools.
>   Send mail to mime@docserver.cac.washington.edu for more info.
> 
> ---242971389-615984271-861311469=:24662
> Content-Type: TEXT/PLAIN; charset=US-ASCII
> 
>  Its came to my attention that there is a buffer overflow bug in
> sperl5.003 that will allow local users gain root access, if SUID root.
>  The exploit and bug was made and brought to my attention by Willy Tarreau
> (tarreau@aemiaif.ibp.fr).
>  Attached is the source for the exploit. Since it requires some work to
> be done to the compiled exploit (Stripping of 5 byte at the begining and
> end of the binary), the precompiled Linux x86 exploit can be found at
> http://www.ecst.csuchico.edu/~jtmurphy/localusers.html.
> 
> PS. Have a nice a day.
> 
> --
> ----------------------------------------------------------------------------
> Jason T. Murphy |  Finger for PGP Public Key  | jtmurphy@ecst.csuchico.edu
>   The Linux Security Home Page -> http://www.ecst.csuchico.edu/~jtmurphy
> Security buff, Linux Freak, PC Tech @ Chico State, and all around nice guy.
> 
> ---242971389-615984271-861311469=:24662
> Content-Type: APPLICATION/octet-stream; name="sperlexp.tgz"
> Content-Transfer-Encoding: BASE64
> Content-ID: <Pine.LNX.3.96.970417141109.24662B@cray1.ecst.csuchico.edu>
> Content-Description:
> 
> H4sIAFcBVTMAA+1a3W7bRhb2rWf3IY6VdCW5FEXq17Wboq5joNk2sRHL6AZt
> kY7IkTQIf7TDoSyi6GKBvepF36WPsBd7tcA+xD7G3u05Q0p2ksJuCltG0PkS
> WyJneOZwZr7znUMzmwsVtbfuFNDzhkMftgBgOOybT7/XM58VPIBBt9PveF7f
> G2Cr7/e7W9C/W7dK5JnmCmALfyvB82v6CZVtwqHNIjPrr1XBo8g1B7c/hu95
> w/416z/sDsr194eDbh/3gt8ddAZb4N2+K2/jd77+D3baY5m0dZDN2APQMwHZ
> TEQRJDwWIDOYyoVIYFxAXQSzFFoJuK5bB56EEOPUwViAWPJARwUMIZhxlcFM
> KOGgsVRBkeZ1NDbjCwE6hTgN5aQoR9E8eAVjngmYYEc6Vf/y+LAOMsm0ygMt
> 0wS/UwOaytJcBdhDLEXg8r1B3cWTL9IcAp5AkM4LaOeZMnciQxqpreO5cVLl
> iTmg82Ra8NCF0YzrOt5bmlLn1GXm3mqn6MDZMTw+gWcnIzjHr6PPn5zB6ASO
> nh8efQGHcPbibHT81IHPzkfw5/OzEbWNjvHzxcn587NvduhfjWVCw4JH8AgD
> 2dBjFzMZCWg8pFMfg9/pec1ywJEqZDIFamBr/w0H+67ndeE7t63m2rQfBFyD
> uXvsc7Bainp5xax+4LZFNgeMn9+xT2nsDz9kIgnZzetf8v/58eHjp8d3tceQ
> /4OBdw3/O70V/4fdYQdbO37Xt/zfBI5mAnmIPFUw53pmyFhtwSXCgXweco2h
> QFdshCxQEnflVckgpjFimtQu0ZI4nwgRAgcKLERIatUzDCjl5S6cmOhgCFxe
> CTFPcjRZuOwkgbiADixwyjEOZA6sWeEbVl+SxKEriRi5FhmOp9JUVyGMa4b8
> 67qMjdBtwbNCYMC64MVr/uB/PMxkPMcQpos5RpmYvxJ1F55QjDiN8mnrWes0
> wsv2W03GHqdJHa2kShXAx2muzaTUMjGNRaK5iVsTnke6RgGwNiHum2CKgQai
> NJnWIBZZxqcic8kxtKKwR6piDA+ZTDDMXcZHdE6JCyW1xiC8w9hXEucHRuVW
> Zazas59yEUsuJ64cz92J+hWsv0TJ/6d4x+Tp3ewx4n/vGv73r+h/x+8T/4de
> 1/J/E0DC7QNpBynNSmDYtvtaSshYEAme7LNtFUNrsu6/66aw+zcUYCUYe2CA
> ujxCocf9tLbmvJkGIPf2AXi2N4DWeN0NVuKOJojjyILyUqRAnC5KWvRhIhWy
> mDr0IeKUgRTE/AuJwYsD2uFITBFKjexrjAVfNNHeE5irdCHDiltlNkF5islK
> yFkaJ09CXGNNtmfpBQUWpPkrpCnd1TvCMPWdmHg/KPmPC+oGdzbGDfzvdHqX
> /B/2u8T/Tqdv+b8JtHdvDW3W3gU44lGQR5QyXMrYPJWJFooS03yV76O0ISen
> iscunBnZQ76FqchIXqEytiAyYxZQYLERYHKi0hjSRKyuJPbyJMWBFCX3a36T
> 3JocwDHHlTEldK4SzEpKNyjzwOoF1zVcRQ9TEPAgyBUPCioTBKDAz1HjKVFI
> sMfasyrQTEi3MeFIcSD8xFuozAZpgim7SPAnvOomFjeU81eojGFnzWVCDRwn
> S5kkIp3g+VC48BVXpmlnx3hUer++GarCzJStjJkoy5OCDEidQa+KkFSVoCOe
> Q3kJxTaMUOQp+lvHWoG6l85h6rM2tqqx5pT/lLOkpguTMeVjjdOEobjySKdX
> CzuBMyOoeiTPK2PSOJDpECfVfdeAukZl7Hbw24yVadgvG7tFOrEHyIsox139
> MU6aTN3ZJ4xllGMGuBsjiUSYClzaeaMJ3zOAly95Fr982cAMM11E8AG2OB8I
> voRa84D9wFiMewwaSEVaxMAx5Trs7tKKlgYoPUUVzOSUdhZefoAnqX8oAh49
> 8uiQzkygQRY+8ZtVC9eppFOLr/1vm1UvvPzRyr2W6UYNE8pmReNP5FvP8Z1y
> NzSvbfrhPdDR9xWl/mMyd3/67/e6w3X93xl4Rv+79vnfRnCLAWt3F0mMEnWp
> 7KuyGkvLKINVrVw+UkzyeIx6iKpj5MmFzwoMJqZyNqpNtqiFpNdb9nxo1A/r
> TbiYSUwEsOJQGCbSJMxQzhLSMMowIjg6PSeNqWHgBBEsa1TFk6UgzaOwlMax
> oAeaQlNCgl1xXeHZySk0vOVHXtOBsfESB6XoiPpGqYXJSf6aY3QiW3MUSc3H
> ERUS5rlIhuW7Ng8YjL6JSAQmFUjXD0xoSPP4AC8/TIoLXjhQe/LsCI6P/lJb
> Zz2YSdBwVH+sTqETybTMaigZqGfoOd6FxArGIWPkwYSShmrCx4onwUxkq4c1
> sQxDdBRnmfITZ5WgmKcfpP/UB8XfJVvst+kgu80dhKL3i6pH0nWdclGTrISH
> 8suGfEOT5IFslfOPC5hrMtCgbdU8AMAMoNovJOGoXEupG97vQ3iq+q8qve9m
> jJue//hDbxX/+/2eef7T92z83wi2MVWkne9gOGXbS6QOJowO/rDteZ7NwHyL
> BAcxXjpfY6fW8Fu2zUOTHjp+52q38tsYvxmjIdoJqgMeOb7Ptomm3nLPY9v3
> fd8WJa7wH0vauxnjJv5D9fefbr8zMLHA79i//24IP/7X/+fpT988/N8//vXH
> 07Mf//3zH/7z9/v2yWJzeO39j6lIhJK3Xgje9P5Hf9i78v5Pj1p9r2P5vwlc
> ff/j8r2Fj/befm3BW7220Erg+enIvJYA++zh7q95T4HewLjmPYUrb0y8PXSn
> t5mhcZg3h+7t3eXQ9732FhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYW
> FhYWFhYWFhYW7yf+D4S0HUYAUAAA
> ---242971389-615984271-861311469=:24662--
> 
> -----End of forwarded message-----
> 
> --
> See shy Jo.
> 
> --
> TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
> debian-private-request@lists.debian.org .
> Trouble?  e-mail to templin@bucknell.edu .


--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-private-request@lists.debian.org . 
Trouble?  e-mail to templin@bucknell.edu .