Nanog traceroute format string exploit. (fwd)

Tue Jul 23 03:58:35 UTC 2002

This came through on bugtraq this afternoon.

-jba
__
 [jba at analogue.net] :: analogue.networks.nyc :: http://analogue.net

---------- Forwarded message ----------
Date: Sun, 21 Jul 2002 14:09:24 +0200
From: SpaceWalker <spacewalker at minithins.net>
To: bugtraq at securityfocus.com
Cc: vuln-dev at securityfocus.com
Subject: Nanog traceroute format string exploit.

Hello,
As the vulnerability has been published some weeks ago, and no working
exploit has been released (the perl exploit was joke) I decided to
release my private exploit.
I do it only because
-This exploit will never be used to haxor something because I never saw
this traceroute used by default
-This exploit find offsets "by the proper way" and doesn't place the
target adresses in the format string. (and is interresting to study for beginners).

Have phun, please don't haxor with it.
SpaceWalker
-------------- next part --------------
A non-text attachment was scrubbed...
Name: tracerouteexp.tgz
Type: application/octet-stream
Size: 4087 bytes
Desc: 
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20020722/ac611ded/attachment.obj>