Everhart, Glenn
From:	Larry W. Cashdollar [lwcashd@TROUT.BIW.COM]
Sent:	Tuesday, January 26, 1999 3:46 PM
To:	BUGTRAQ@NETSPACE.ORG
Subject:	Re: Digital Unix 4.0 exploitable buffer overflows
I decided to inspect this a little more on a Digital unix box I had access too.



alpha>> uname -a
OSF1 xxx V4.0 878 alpha
alpha>> head -1 /etc/motd
Digital UNIX V4.0D  (Rev. 878); Tue Jul  7 08:39:27 EDT 1998
alpha>> ls -l /usr/bin/mh/inc
-rws--x--x   1 root     bin        73728 Dec 29  1997 /usr/bin/mh/inc*

alpha>> /usr/bin/mh/inc +foo -audit `perl -e 'print "a" x 8169'` foo
Segmentation fault
alpha>> /usr/bin/mh/inc +foo -audit `perl -e 'print "a" x 8168'` foo
Illegal instruction
alpha>> /usr/bin/mh/inc +foo -audit `perl -e 'print "a" x 8167'` foo
Segmentation fault
alpha>> /usr/bin/mh/inc +foo -audit `perl -e 'print "a" x 8166'` foo
inc: usage: inc [+folder] [switches]

We see at 8168 a's we have overflowed the return address.  If I wasnt married
I could probably follow this up with the exploit.  Just a little nop padding and
I think it would be the perfect example of a buffer overflow exploit.


-- Larry W. Cashdollar