Message-Id: <200102081259.HAA19645@tiramisu.lcs.mit.edu>
To: security-internal@MIT.EDU
Subject: John Jannotti: I was almost 0wn3d!
Date: Thu, 08 Feb 2001 07:59:16 EST
From: Kevin Fu <fubob@MIT.EDU>

fyi, bind is being actively exploited on campus now.

--------
Kevin E. Fu (fubob@mit.edu)
PGP key: https://snafu.fooworld.org/~fubob/pgp.html

------- Forwarded Message
To: "Kevin E. Fu" <fubob@MIT.EDU>, fdabek@MIT.EDU
Subject: I was almost 0wn3d!
From: John Jannotti <jj@lcs.mit.edu>
Date: 08 Feb 2001 06:22:18 -0500


I was nearly owned.  Someone exploited bind to run commands as the named
user.  Fortunately that's "named" on my system.  But they then ran a
suidperl exploit that supposedly takes advantage of a race condition to get
a local user a root shell.  That's when I magically woke up at 5:30am and
noticed my load spiked.  I killed everything before it succeeded (as
evidenced by the intended root shell still being owned by named and not
suid).

I have the suidperl "exploit" (maybe it doesn't even work) detritus laying
around if either of you are interested.  Checking timestamps it looks like
it was running for 4 hrs without yielding a root shell, possibly because my
laptop is slow.

I've upgraded bind on both my machines.

  jj


------- End of Forwarded Message