Solaris ufsroot exploit

[job () ITSX COM (Job de Haas)]

Hi,

I've got two questions regarding exploiting the ufsroot bug I posted
about on bugtraq.

First, has anyone ever looked at acurate prediction of the position of
the shellcode? My idea was that this would result in more reliable exploits
and even (semi-)automatic exploits. Maybe a little far fetched, especially with
sparc due to the delayed register window stuff. I've always found the get_sp
solution and wildly varying environments ugly.

Second, would there be a way to exploit this bug with an non-executable
stack? The program /usr/lib/fs/ufs/ufsrestore is a statically linked
binary, resulting in a memory map with lots of 00. I looked some at it,
but didn't really come up with anything.

Regards,

Job