-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi list!@ hehehehe ;PPpPPPPPp It appear Max Vozeler who wrap he packages for he debian friends did travel back in time with he timemachine of many speed. Friend GOBBLES not buy into whole space/time discussion ;PPpPPPP But anyways here is friend GOBBLES of old! From he hushmail electronic mail of 2002. Look here: http://lists.netsys.com/pipermail/full-disclosure/2004-June/022831.html GOBBLES did read: Package : super Vulnerability : format string Problem-Type : remote Debian-specific: no CVE Ids : CAN-2004-0579 Max Vozeler discovered a format string vulnerability in super, a program to allow specified users to execute commands with root privileges. This vulnerability could potentially be exploited by a local user to execute arbitrary code with root privileges. Probably smart to remember ripping published advisory that get small bit of mediocre media attention come back to bite you in the ass (related to butt, not mule hehehehe) but GOBBLES say that all in the behind! Now GOBBLES pioneer many things and he appreciate new pioneering when it not stale, so observe many fast patching here in Max patch: --- super-3.16.1.orig/error.c +++ super-3.16.1/error.c @@ -168,12 +168,12 @@ void rsyslog P__(( unsigned int level, char *fmt, ... )); #define OpenLog(prog, opt, fac) ropenlog((prog), (opt), (fac), error_rlog_host) -#define SysLog(pri, buf) rsyslog((pri), (buf)) +#define SysLog(pri, buf) rsyslog((pri), "%s", (buf)) #else #define OpenLog(prog, opt, fac) openlog((prog), (opt), (fac)) -#define SysLog(pri, buf) syslog((pri), (buf)) +#define SysLog(pri, buf) syslog((pri), "%s", (buf)) #endif Ding ding ding! Deja vu. GOBBLES would like to point out he 2002 fame in 2002 (year of turkey): http://lists.netsys.com/pipermail/full-disclosure/2002-July/000308.html * Problem: * * When super is compiled to use syslog(3) for its logging * of error messages the following lines makes pre-auth * local root exploitation rather trivial: * * From error.c * ... * #define SysLog(pri, buf) syslog((pri), (buf)) * ... * SysLog(error_priority, buf); * ... * * This means users that are not in the super config file * will be able to execute code with root priviledges. * * "Super acts as a SetUID wrapper around system commands * to make sure the commands are executed safely, and * only by authorized users." * * hehehe ;PPpPPPPp * * Love, * GOBBLES GOBBLES would like to take this opportunity to thank Max for celebrating the two year aniversary of the SUPER bug. Thanks friend Max, you get free t-shirt at defcon 2002 ;pPPpPPPpPP For special bonus treat see debian patch history. GOBBLES wonder who keep backdoor in anti-spam stale linux alive!? It a mystery! References: http://www.debian.org/security/2002/dsa-139 http://www.debian.org/security/2004/dsa-522 Debian project recommend replacing backdoored super program with new version. GOBBLES would rather like to recommend concerned security professional to replace Debian with better Linux, like 7350 Linux. German friend at 7350 Linux Inc. is good at patching the many GOBBLES bugs in he Linux. Friend GOBBLES also need to take time to point out old Security Focus page is outdated and urgently has to be updated to reflect this mysterious bug! Outdated web page is here: http://www.securityfocus.com/bid/5367 Love, GOBBLES GOBBLES@xxxxxxxxxxxx -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkDW3FsACgkQHNGnlyGZsA88vACfZ1zGct4qQ6EXJa8/EFtYDcNrif4A oI3dqVSASPtpU6mazvKRS+Qt61zf =+MB3 -----END PGP SIGNATURE-----
