Re: Various Buffer Overflows in Oracle 10g Tools

To: "Joxean Koret" <joxeankoret@xxxxxxxx>, "Security Tracker" <bugs@xxxxxxxxxxxxxxxxxxx>, "Secunia" <vuln@xxxxxxxxxxx>, <bugtraq@xxxxxxxxxxxxxxxxx>, <siaaypee@xxxxxxxxxxxxx>
Subject: Re: Various Buffer Overflows in Oracle 10g Tools
From: "David Litchfield" <davidl@xxxxxxxxxxxxxxx>
Date: Sat, 22 Jan 2005 01:55:35 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <1106258673.31088.0.camel@nemobox>

Hi Jose,

I'm away from my linux box at the moment; are any of these toolssetuid/setgid? I'm trying to ascertain the risk posed. If none of theseoverflows present a privilege escalation opportunity then there is no riskposed. If these tools are setuid/setgid then, needless to say there is arisk.

Cheers,
David Litchfield

----- Original Message -----From: "Joxean Koret" <joxeankoret@xxxxxxxx>To: "Security Tracker" <bugs@xxxxxxxxxxxxxxxxxxx>; "Secunia"<vuln@xxxxxxxxxxx>; <bugtraq@xxxxxxxxxxxxxxxxx>; <siaaypee@xxxxxxxxxxxxx>

Sent: Thursday, January 20, 2005 10:04 PM
Subject: Various Buffer Overflows in Oracle 10g Tools

References:
- Various Buffer Overflows in Oracle 10g Tools
  - From: Joxean Koret

Prev by Date: Call for DEFCON Capture the Flag Organizers.
Next by Date: [ GLSA 200501-29 ] Mailman: Cross-site scripting vulnerability
Previous by thread: Various Buffer Overflows in Oracle 10g Tools
Next by thread: bug report comersus Back Office Lite 6.0 and 6.0.1
Index(es):
- Date
- Thread