I'm not seein' it... Not an overflow on method since the < means the null is
written at offset 15. Not even an infinite loop, since length is capped at
10 before this.
~ Puss
-----Original Message-----
From: dailydave-bounces at lists.immunitysec.com
[mailto:dailydave-bounces at lists.immunitysec.com] On Behalf Of Phrack Senate
Omniscient
Sent: Tuesday, March 06, 2007 6:28 AM
To: Dailydave at lists.immunitysec.com
Subject: Re: [Dailydave] Ferret
On 3/5/07, Ronaldo Vasconcellos <ronaldo at cais.rnp.br> wrote:
>
> Very interesting tool, folks.
>
> When I sent a message to wifisec at securityfocus on Friday it was just an
> announcement made on Black Hat DC, but Maynor released the tool in the
> same day.
seepage
> Errata Security: Ferret
> http://www.erratasec.com/ferret.html
"probably has a remote vulnerability"
aka
"we dun know how to code proper. lulz!!! :("
Ferret-1/Ferret/http.c:
void process_simple_http(struct Seaper *seap, struct NetFrame *frame,
const unsigned char *px, unsigned length) {
char method[16];
...
x=0;
while (i<length && !isspace(px[i])) {
if (x < sizeof(method) -1) {
method[x++] = (char)toupper(px[i++]);
method[x] = '\0';
}
}
ur code getting owned in less than 60 seconds: priceless
knowing that ur code prolly has a dozen other elementary errors
resulting in memory corruption: just fucking embarassing
Some at Black Hat called it "serious fucking business".
---
phrack senate omniscient
fighting internet crime with internet rhymes
fuck the high council
_______________________________________________
Dailydave mailing list
Dailydave at lists.immunitysec.com
http://lists.immunitysec.com/mailman/listinfo/dailydave