5229809 2000-06-26 20:40 /170 rader/ Postmaster Mottagare: Bugtraq (import) <11435> Ärende: format bugs, in addition to the wuftpd bug ------------------------------------------------------------ Approved-By: aleph1@SECURITYFOCUS.COM Delivered-To: bugtraq@lists.securityfocus.com Delivered-To: bugtraq@securityfocus.com X-Originating-IP: [213.224.83.14] Mime-version: 1.0 Content-Type: multipart/mixed; boundary="=====================_889472414==_" Message-ID: <20000624195754.3020.qmail@fiver.freemessage.com> Date: Sat, 24 Jun 2000 19:57:54 -0000 Reply-To: Lamagra Argamal <lamagra@HACKERMAIL.NET> Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM> From: Lamagra Argamal <lamagra@HACKERMAIL.NET> To: BUGTRAQ@SECURITYFOCUS.COM --=====================_889472414==_ Content-Type: text/plain; charset="us-ascii" For all of you who don't understand these kind of bugs, they are really really new so don't feel bad. I've written a small (ugly) introduction into these kind of bugs. Don't expect too much, but it explain it good enough. Enjoy -lamagra http://lamagra.seKure.de Send someone a cool Dynamitemail flashcard greeting!! And get rewarded. GO AHEAD! http://cards.dynamitemail.com/index.php3?rid=fc-41 --=====================_889472414==_ Content-Type: text/plain; name="Format_b" Content-Transfer-Encoding: base64 Content-Description: Format_b Content-Disposition: attachment; filename="Format_b" CUZvcm1hdCBCdWdzOiBXaGF0IGFyZSB0aGV5LCBXaGVyZSBkaWQgdGhleSBj b21lIGZyb20sLi4uLi4uCgkJICAgIC4uLkhvdyB0byBleHBsb2l0IHRoZW0K CQkgICAgCgkJICAgIGJ5IGxhbWFncmEgPGxhbWFncmFAZGlnaWJlbC5vcmc+ CgkJICAgIAotLS0tLS0tPiBXaGF0IGFyZSB0aGV5CgpUaGUgY29uY2VwdCBp cyBxdWl0ZSBzaW1wbGU6IHdoZW4gYSAqcHJpbnRmKCkgZnVuY3Rpb24gKGVn LiBwcmludGYoY2hhciAqZm10LC4uLikpCmlzIGNhbGxlZCBhbmQgZm10IGlz IHVzZXItc3VwcGxpZWQuIFRoZSB1c2VyIGNhbiBwdXQgaW4gZm9ybWF0c3Ry aW5ncyAlcyAlcCAleAppbiB0aGUgZm10LiAqcHJpbnRmIHdpbGwgdGhlbiAi Y29udmVydCIgdGhlbSB3aXRoIHRoZSBzdXBwbGllZCBhcmd1bWVudHMuClBy b2JsZW0gaXMgKnByaW50ZigpIGRvZXNuJ3Qga25vdyB3aGVyZSBpdCdzIGFy Z3VtZW50cyBzdG9wLiBXaGVuIGEgbmV3IApmb3JtYXRzdHJpbmdzIGl0IGp1 c3QgcmVhZHMgdGhlIG5leHQgdGhpbmcgb24gdGhlIHN0YWNrLiBMZXRzIGhh dmUgYSBsb29rCmF0IGFuIGV4YW1wbGUuCgo8Kys+IHB0ZXN0LmMKI2luY2x1 ZGUgPHN0ZGFyZy5oPgoKYmxhYXQoY2hhciAqZm10LC4uLikKewogICAgdmFf bGlzdCB2YTsKICAgIGludCBpOwogICAgY2hhciAqYWRkcjsKICAgIAogICAg dmFfc3RhcnQodmEsZm10KTsKCiAgICBwcmludGYoIi0tLXwgYmVnaW4gfC0t LVxuIik7ICAgIAogICAgZm9yKGkgPSAwO2kgPCA1O2krKykKICAgIHsKCWFk ZHIgPSB2YV9hcmcodmEsY2hhciAqKTsKCXByaW50ZigiJXBcbiIsYWRkcik7 CiAgICB9CiAgICBwcmludGYoIi0tLXwgIGVuZCAgfC0tLVxuIik7CiAgICAK ICAgIHZhX2VuZCh2YSk7Cn0KCm1haW4oaW50IGFyZ2MsY2hhciAqKmFyZ3Yp CnsgIAogICAgY2hhciBidWZbOF07CiAgICBjaGFyICpwcm90ID0gKGNoYXIg KikweDEyMzQ1Njc4OwogICAgCiAgICBzdHJuY3B5KGJ1Zixhcmd2WzFdLDgp OwogICAgCiAgICBibGFhdChhcmd2WzFdKTsKICAgIHByaW50Zihhcmd2WzFd KTsKICAgIHB1dGNoYXIoJ1xuJyk7Cn0KPC0tPgoKZGFya3N0YXI6L3RtcC90 ZW1wIyBnY2MgcHRlc3QuYyAtb3B0ZXN0CmRhcmtzdGFyOi90bXAvdGVtcCMg cHRlc3QgYmxhYXQKLS0tfCBiZWdpbiB8LS0tCjB4MTIzNDU2NzgKMHg2MTYx NmM2MgoweGJmZmYwMDc0CjB4YmZmZmZiMjQKMHg4MDQ4NTVlCi0tLXwgIGVu ZCAgfC0tLQpibGFhdAoKQSBzaW1wbGUgYXJndW1lbnQgbWFrZXMgaXQgcHJp bnQgdGhlIDUgdGhpbmdzIG9uIHRoZSB0b3Agb2YgdGhlIHN0YWNrIGJlZm9y ZSB0aGUKY2FsbCB0byBibGFhdCgpLiBZb3UgY2FuIHNlZSAweDEyMzQ1Njc4 IHdoaWNoIGlzIHRoZSBjb250ZW50IG9mICdwcm90JyBhbmQgdGhlCmNvbnRl bnQgb2YgYnVmIG5hbWVseSBvdXIgYXJndW1lbnQuIFRoZSBvdXRwdXQgb2Yg cHJpbnRmKCkgaXMganVzdCBvdXIgYXJndW1lbnQuCk5vdyBsZXRzIHJ1biBp dCBhZ2FpbiB3aXRoIHNvbWUgZm9ybWF0c3RyaW5ncyBpbiB0aGUgYXJndW1l bnQsIEkgdXNlICVwIHNpbmNlIGl0CmRvZXNuJ3QgY3Jhc2ggdGhlIHByb2dy YW0uCgpkYXJrc3RhcjovdG1wL3RlbXAjIHB0ZXN0IEFBQUElcAotLS18IGJl Z2luIHwtLS0KMHgxMjM0NTY3OAoweDQxNDE0MTQxCjB4YmYwMDcwMjUKMHhi ZmZmZmIyNAoweDgwNDg1NWUKLS0tfCAgZW5kICB8LS0tCkFBQUEweDEyMzQ1 Njc4CgpOb3cgdGhlIG91dHB1dCBvZiBwcmludGYoKSBpcyBxdWl0ZSBpbnRl cmVzdGluZy4gSXQgcHJpbnRzIDQgdGltZXMgJ0EnIGFuZCB0aGUKJXAgaXMg cmVwbGFjZWQgYnkgdGhlIGFkZHJlc3Mgb24gdG9wIG9mIHRoZSBzdGFjay4g V2hlbiB5b3UnZCBhZGQgbW9yZSAlcCdzIHRvCnRoZSBhcmd1bWVudCB5b3Un bGwgc2VlIGV2ZXJ5IG90aGVyIGVsZW1lbnQgb24gdGhlIHN0YWNrIGdldHMg cHJpbnRlZC4KCi0tLS0tLT4gSG93IHRvIGV4cGxvaXQgdGhlbT8KCkZpcnN0 IHRoaW5nIHRvIGRvIGlzLCBjaGVjayBvdXQgdGhlIG90aGVyIGtpbmRzIG9m IGZvcm1hdHN0cmluZ3M6CiVjLCAlZiwgJWQsICVzLCAlcCwgJWksICVuLCBl dGMKCiVuIGlzIHByb2JhYmx5IHRoZSBtb3N0IGludGVyZXN0aW5nLCBpdCB3 cml0ZXMgdGhlIG51bWJlciBvZiBieXRlcyBwcmludGVkIHRvCnRoZSBsb2Nh dGlvbiBwb2ludGVkIHRvIGJ5IGl0J3MgYXJndW1lbnQuCgpzaW1wbGUgZXhh bXBsZToKaW50IHE7CnByaW50ZigiQUFBQSVuIiwmcSk7CnEgPSA0IGFmdGVy IHRoYXQKCkFzIHdlJ3ZlIHNlZW4gZnJvbSBvdXIgcHJldmlvdXMgdGVzdHMs IG91ciBhcmd1bWVudCBjb3BpZWQgaW50byBidWYsIGlzIG9uIHRoZSAKc3Rh Y2sgYXN3ZWxsLiBXaGF0IGlmIHdlIHJlcGxhY2VkIHRoZSBBQUFBIHdpdGgg YSB2YWxpZCBhZGRyZXNzIGFuZCB0aGVuIHdyb3RlCnRvIHRoYXQgYWRkcmVz cyB1c2luZyAlbi4gTGV0cyBzZWUKZGFya3N0YXI6L3RtcC90ZW1wIyBnZGIg LS1leGVjPWEub3V0IC0tc3ltYm9scz1wdGVzdApHTlUgZ2RiIDQuMTcKQ29w eXJpZ2h0IDE5OTggRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uLCBJbmMuCkdE QiBpcyBmcmVlIHNvZnR3YXJlLCBjb3ZlcmVkIGJ5IHRoZSBHTlUgR2VuZXJh bCBQdWJsaWMgTGljZW5zZSwgYW5kIHlvdSBhcmUKd2VsY29tZSB0byBjaGFu Z2UgaXQgYW5kL29yIGRpc3RyaWJ1dGUgY29waWVzIG9mIGl0IHVuZGVyIGNl cnRhaW4gY29uZGl0aW9ucy4KVHlwZSAic2hvdyBjb3B5aW5nIiB0byBzZWUg dGhlIGNvbmRpdGlvbnMuClRoZXJlIGlzIGFic29sdXRlbHkgbm8gd2FycmFu dHkgZm9yIEdEQi4gIFR5cGUgInNob3cgd2FycmFudHkiIGZvciBkZXRhaWxz LgpUaGlzIEdEQiB3YXMgY29uZmlndXJlZCBhcyAiaTU4Ni1zbGFja3dhcmUt bGludXgiLi4uCihnZGIpIHIKU3RhcnRpbmcgcHJvZ3JhbTogL3RtcC90ZW1w L2Eub3V0CgpQcm9ncmFtIHJlY2VpdmVkIHNpZ25hbCBTSUdUUkFQLCBUcmFj ZS9icmVha3BvaW50IHRyYXAuCkNhbm5vdCByZW1vdmUgYnJlYWtwb2ludHMg YmVjYXVzZSBwcm9ncmFtIGlzIG5vIGxvbmdlciB3cml0YWJsZS4KSXQgbWln aHQgYmUgcnVubmluZyBpbiBhbm90aGVyIHByb2Nlc3MuCkZ1cnRoZXIgZXhl Y3V0aW9uIGlzIHByb2JhYmx5IGltcG9zc2libGUuCjB4ODA0ODA5MCBpbiBf X19jcnRfZHVtbXlfXyAoKQooZ2RiKSBicmVhayAqbWFpbis2MApCcmVha3Bv aW50IDEgYXQgMHg4MDQ4MjFjOiBmaWxlIHB0ZXN0LmMsIGxpbmUgMzAuCihn ZGIpIGJyZWFrICptYWluKzY1CkJyZWFrcG9pbnQgMiBhdCAweDgwNDgyMjE6 IGZpbGUgcHRlc3QuYywgbGluZSAzMC4KKGdkYikgYwpDb250aW51aW5nLgot LS18IGJlZ2luIHwtLS0KMHgxMjM0NTY3OAoweGJmZmZmYjEwCjB4NmUyNTcw MjUKMHhiZmZmZmIwMAoweDgwNDgwZWUKLS0tfCAgZW5kICB8LS0tCgpCcmVh a3BvaW50IDEsIDB4ODA0ODIxYyBpbiBtYWluIChhcmdjPTIsIGFyZ3Y9MHhi ZmZmZmJhMCkgYXQgcHRlc3QuYzozMAozMCAgICAgICAgICBwcmludGYoYXJn dlsxXSk7CihnZGIpIHgvd3ggMHhiZmZmZmIxMAoweGJmZmZmYjEwOiAgICAg MHgwMDAwMDAwMAooZ2RiKSBjCkNvbnRpbnVpbmcuCgpCcmVha3BvaW50IDIs IDB4ODA0ODIyMSBpbiBtYWluIChhcmdjPTIsIGFyZ3Y9MHhiZmZmZmJhMCkg YXQgcHRlc3QuYzozMAozMCAgICAgICAgICBwcmludGYoYXJndlsxXSk7Cihn ZGIpIHgvd3ggMHhiZmZmZmIxMAoweGJmZmZmYjEwOiAgICAgMHgwMDAwMDAw ZQooZ2RiKSBjCkNvbnRpbnVpbmcuCvugvzB4MTIzNDU2NzgKClByb2dyYW0g ZXhpdGVkIHdpdGggY29kZSAwMTIuCihnZGIpIHEKZGFya3N0YXI6L3RtcC90 ZW1wIwoKYS5vdXQgaXMgYSBzaW1wbGUgcHJvZ3JhbSB0aGF0IGV4ZWN1dGVz IHB0ZXN0IHdpdGggXHgxMFx4ZmJceGZmXHhiZiVwJW4gYXMgCmFyZ3VtZW50 LCBhcyB5b3UgY2FuIHNlZSAlcCBwcmludHMgdGhlIGZpcnN0IGFkZHJlc3Mg YW5kICVuIHdyaXRlcyB0byAweGJmZmZiMTAuClByZXR0eSBuZWF0IGVoLCBJ IHRoaW5rIGl0IGlzLgoKV2hhdCBjYW4gSSBkbyB3aXRoIHRoaXMsIHlvdSBh c2suIFdlbGwgeW91IGNhbiBvdmVyd3JpdGUgYW55dGhpbmcgaW5zaWRlIHRo ZSAKcHJvZ3JhbSAoZXhjZXB0IHJlZ2lvbnMgbWFwcGVkIFBST1RfV1JJVEUg bGlrZSAudGV4dCkuIFRoaXMgY2FuIGJlIG1hbnkgdGhpbmdzCkluIG15IHBy b2Z0cGQgZXhwbG9pdCBJIGNob3NlIGZvciB0aGUgc2F2ZWQgdWlkIGFuZCBw YXJ0IG9mIHRoZSBjb25maWdzIGluIG1lbS4KVGhlIGRhZW1vbiByZWxpbnF1 aXNoZXMgcm9vdHByaXZpbGVkZ2VzIGZvciBvcGVuaW5nIGEgZGF0YWNvbm5l Y3Rpb24gCihvbiBMSVNULFJFVFIsZXRjKSBhZnRlciB0aGF0IGl0IGNoYW5n ZXMgYmFjayB0byB0aGUgb2xkIHVpZCAoc2F2ZWQgaW4gbWVtKS4KVGhlIGdl bmVyYWwgaWRlYSB3YXMgdG8gemVybyB0aGF0IHVpZCwgb3BlbiBhIGRhdGFj b25uZWN0aW9uIGFuZCB1cCB3aXRoIHJvb3QKcHJpdmlsZWRnZXMgaW5zaWRl IHByb2Z0cGQuIFdpdGggbG9jYWwgYWNjZXNzIHRoaXMgaXMgZW5vdWdoLCB5 b3UgdXBsb2FkIGEgYmFja2Rvb3IKYW5kIENITU9EIDQ3NTUgKC1yd3NyLXhy LXgpIHByb2Z0cCBhbGxvd3Mgc3VpZHNnaWQgZmxhZ3MgdW5saWtlIHd1ZnRw ZC4gCkJ1dCB3aXRoIGFub255bW91cyBhY2Nlc3MsIHlvdSBjb3VsZG4ndCB3 cml0ZSB0byBkaXNrIGJlY2F1c2Ugb2YgdGhlIGNvbmZpZ3VyYXRpb24uClNp bXBsZSB0aGluZyB0byBkbyBpcywgY29ycnVwdCB0aGUgY29uZmlndXJhdGlv bi4gSW4gdGhpcyBjYXNlIGNvcnJ1cHQgdGhlICdEZW55QWxsJwpzZXR0aW5n LgpPdGhlciB0aGluZ3MgdG8gZG8gYXJlIGVnLiBjaGFuZ2UgdGhlIGxhc3Qg Ynl0ZSBvZiBhIHN0YWNrcG9pbnRlciwgZGF0YSBpbiBtZW1vcnkuCmFuZCBs b3RzIG1vcmUuCgpBbiBpbnRlcmVzdGluZyB0aGluZyBpbiB0aGUgbmV3IGds aWJjIHZlcnNpb24gaXMgdGhhdCBmb3IgZXhhbXBsZSAlPGxvbmcgbnVtYmVy PmQKd29ya3MgZXZlbiB3aXRoIHNucHJpbnRmKCksIG9uIG9sZGVyIGdsaWJj J3MgaXQganVzdCBjcmFzaGVzLiAKCiotIG5vdGUgLSoKIiUuNWQiLDUgb3V0 cHV0cyAwMDAwNQoiJS4yMDAwMDBkIiBvdXRwdXRzIDIwMDAwMCBieXRlcwoq LSBub3RlIC0qCgpXaXRoIHRoaXMgYWR2YW50YWdlIHlvdSBjb3VsZCBhbHNv IGNoYW5nZSA8c2F2ZWQgJWVpcD4sIGZ1bmN0aW9uIHBvaW50ZXJzLApqbXBf YnVmJ3MgZXRjIGV0YwoKQWxsIHRoaXMgaXMgdmVyeSBuaWNlLCBidXQgaXQg Y2FuIGdldCByZWFsbHkgaGFyZCBzb21ldGltZXMuIFNvbWUgc29ydCBvZgp1 c2VyZGVmaW5lZCBzdHJpbmcgaGFzIHRvIGJlIHNvbWV3aGVyZSBvbiB0aGUg c3RhY2sgd2hlbiB0aGUgZnVuY3Rpb24gaXMgY2FsbGVkLgpUaGlzIHJlcXVp cmVzIHNvbWUgZmlkZGxpbmcgYW5kIHNvbWUgc3RhY2tiYWNrdHJhY2luZy4g U29tZXRpbWVzIHlvdSBoYXZlIHRvIGdvCmJhY2sgYSBmZXcgZnVuY3Rpb25z IGJlZm9yZSBhIGJ1ZmZlciBpcyBpbiByZWFjaC4gCkNvbmNsdXNpb246IHRo ZXNlIGJ1Z3MgYXJlIGJpZywgc29tZXRpbWVzLi4uLgoKVGhpcyBjb25jbHVk ZXMgdGhpcyBzbWFsbCBpbnRyb2R1Y3Rpb24gaW50byBmb3JtYXQgYnVncy4g SWYgeW91IHdhbnQgdG8gcGxheQpzb21lIG1vcmUgd2l0aCB0aGlzIGtpbmQg b2YgYnVncywgZmlkZGxlIGEgYml0IHdpdGggdGhlIHB0ZXN0IHByb2dyYW0u IApBbmQgbWF5YmUgdHJ5IGV4cGxvaXRpbmcgdGhlIGZ0cCBwcm9ncmFtIG9u IGJzZCwgbGludXgsIHdpbmRvd3MuLi4gaXQgaGFzIHRoaXMKc29ydCBvZiBo b2xlIGluIHRoZSBRVU9URSBjb21tYW5kLiBUaGlzIGlzbid0IGEgYmlnIHRo aW5nIGJ1dCBuaWNlIHRvIHBsYXkgd2l0aC4KCi0tLS0tLT4gVGhlIGVuZCAK aHR0cDovL2xhbWFncmEuc2VLdXJlLmRl --=====================_889472414==_-- (5229809) ------------------------------------------(Ombruten)