On Mon, Nov 27, 2006 at 09:29:33PM +0000, Tavis Ormandy wrote:
> Gabriel, I was referring to this line:
>
> awk '!/#/ && /\./ && !a[$0]++
> {print "iptables -A INPUT -s "$1" -i eth0 -d '$ifaddr' -p TCP --dport 22
> -j REJECT"}' /etc/hosts.deny |\
> awk '/iptables/ && !/#/ && !/-s -i/'|sh
>
> (note the |sh), $1 can be controlled by specially crafted attempted
> logins.
Aha.
Yep, sure can!
I couldn't find where the malicious input was actually executed, but
I didn't spend long looking.
I take back my take back.
--
gabriel rosenkoetter
gr@xxxxxxxxxxxx
Attachment:
pgplpAIMaXgYQ.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/