oss-sec mailing list archives
nvi denial of service
From: coypu () sdf org
Date: Thu, 9 Nov 2017 02:32:55 +0000
hello, there is an exploitable flaw in virecover in nvi (as used by netbsd and possibly others). the gist of it: sudo touch /myrootownedfile touch /var/tmp/vi.recover/vi. myrootownedfile sudo service virecover restart # may happen naturally now /myrootownedfile is deleted by the choice of an unprivileged user. for your convenience, attached is the patch used in netbsd and commit messages. (Found by Maya Rashish, fix by Christos Zoulas and Robert Elz).
Attachment:
nvi.diff
Description:
Current thread:
- nvi denial of service coypu (Nov 08)
- Re: nvi denial of service Jakub Wilk (Nov 09)