Bugtraq mailing list archives

Re: Exploitable buffer overflow in bootpd (most unices)

From: chris () FERRET LMH OX AC UK (Chris Evans)
Date: Sun, 13 Dec 1998 12:42:21 +0000


On Wed, 25 Jun 1997, Willem Pinckaers wrote:

We don't know of any unix system that is NOT vulnerable to this problem.
Exploit code was tested against linux systems running debian 2.0 (glibc), and
debian 1.3, both running bootpd 2.4.3.


This is old news. I spotted the problem several months ago.

For a non-vulnerable UNIX system try Redhat-5.2. Regardless, RedHat don't
enable bootpd by default (dhcp is used).

Oh, I think OpenBSD fixed this too. One of the few vendors who actually
take note when you explain there is a security bug.

Chris

Current thread:

RSI.0012.12-03-98.SOLARIS.MKCOOKIE RSI Advise (Dec 03)
- Re: RSI.0012.12-03-98.SOLARIS.MKCOOKIE Pavel Kankovsky (Dec 04)
- <Possible follow-ups>
- Re: RSI.0012.12-03-98.SOLARIS.MKCOOKIE Readwin, Neil (Dec 07)
  - Exploitable buffer overflow in bootpd (most unices) Willem Pinckaers (Jun 24)
    - Re: Exploitable buffer overflow in bootpd (most unices) Chris Evans (Dec 13)
    - Triteal release updated CDE with security fixes Alan Cox (Dec 13)
    - Wietse's Postfix (was VMailer) software release Wietse Venema (Dec 13)
  - Re: RSI.0012.12-03-98.SOLARIS.MKCOOKIE Chris Wedgwood (Dec 10)
  - FW: ISSalert: ISS Security Advisory: HP JetDirect TCP/IP problems Phear Me (Dec 11)
  - Pine 4.05 patches GvS (Dec 12)
  - Microsoft's Network Monitor - Buffer Overrun / Page Fault / mnemonix (Dec 12)