Date: Thu, 10 Sep 1998 14:53:10 +0100 (BST) From: Jay Tribick <netadmin@fastnet.co.uk> To: freebsd-security@FreeBSD.ORG Subject: Re: Err.. cat exploit.. (!) Message-ID: <Pine.BSF.3.96.980910145120.408m-100000@bofh.fast.net.uk> In-Reply-To: <3.0.3.32.19980910084313.011f48f0@207.227.119.2>
next in thread | previous in thread | raw e-mail | index | archive | help
| >Was just having a look in /var/log the other day and spotted | >a file called sendmail.st, wondering what it was I cat'd it | >and here's what it did: | > | >bofh$ cat sendmail.st | >`ay5habf33*`ma}`)`Jj]: Jsu-2.01$ xtermxterm | >su: xtermxterm: command not found | >bofh$ | > | >This seems quite scarey to me, couldn't someone embed 'rm -rf /' | >within a text file and then, if root cats the file it nukes | >their system? | > | >Here's an 'od' dump of the file, unfortunately I don't have the | >time to investigate this further: | > | >bofh$ od sendmail.st | --snip-- | | It is a binary file. | | The sendmail.st file is used for mailer stats for sendmail ala mailstats: | | # mailstats | Statistics from Thu Sep 3 05:10:01 1998 | M msgsfr bytes_from msgsto bytes_to msgsrej msgsdis Mailer | 3 2060 6227K 45 60K 0 0 local | 5 0 0K 2073 6207K 0 0 esmtp | ============================================================= | T 2060 6227K 2118 6267K 0 0 | | Terminals don't like it when you cat a binary. It's not the fact that it was a binary that puzzled me but that it had managed to execute a command on the shell just by me cat'ing the file. Forgot to mention that it was in an xterm and doesn't affect Virtual Consoles. Regards, Jay Tribick <netadmin@fastnet.co.uk> -- [| Network Admin | FastNet International | http://fast.net.uk/ |] [| Finger netadmin@fastnet.co.uk for contact info & PGP PubKey |] [| +44 (0)1273 T: 677633 F: 621631 e: netadmin@fast.net.uk |] To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.96.980910145120.408m-100000>