AIX LC_MESSAGES /usr/sbin/mount and /bin/host holes

Overview

Summary

Standard buffer overflow.

Category

Exploit: A way of breaking into a system. An exploit takes advantage of a weakness in a system in order to hack it. Exploits are the root of the hacker culture. Hackers gain fame by discovering an exploit. Others gain fame by writing scripts for it. Legions of script-kiddies apply the exploit to millions of systems, whether it makes sense or not. Since people make the same mistakes over-and-over, exploits for very different systems start to look very much like each other. Most exploits can be classified under major categories: buffer overflow, directory climbing, defaults, Denial of Service.

Origins

Author

Georgi Guninski

Others By This Author

AIX 4.2 lquerylv exploit · AIX 4.2/4.1 LC_MESSEGAS /usr/sbin/mount exploit · AIX dtaction and HOME Exploit · AIX lquerylv overflow · AIX powerPC gethostbyname() and /bin/host exploits · Aix_lchangelv.c · Aix_mount_1.c · Aixdtact.c · Aixdtterm · Aixploit · Aixtterm.c · Dtaction.c · Dtterm_4.2.c · Excel 2000 vulnerability - executing programs · Full Disclosure Exploit · Hotmail security hole - injecting JavaScript · IE 5 and Access 2000 vulnerability - executing programs · IE 5 Cross-frame security vulnerability using IFRAME and WebBrowser control · IE 5.5/Outlook security vulnerability - com.ms.activeX.ActiveXComponent allows executing arbitrary programs · IE 5.x allows executing arbitrary programs using .chm files · IE 5.x Win2000 Indexing service vulnerability · IE5-msn.exec.txt · IIS 5.0 cross site scripting vulnerability - using .htw · Internet Explorer 5.0 under Windows 95/NT 4.0 exploit · Lquerylv exploit · MS Word and MS Access vulnerability · Netscape Communicator 4.5 can read local files · Netscape Communicator find() vulnerabilities · Netscape Communicator window spoofing bug · Outlook Express 5 vulnerability · Ssg-arp.c · Test2.c · Yet another Hotmail security hole - injecting JavaScript in IE ·

Date of Origin

December, 2000

Detection and Removal

Manual Removal

Follow these steps to remove AIX LC_MESSAGES /usr/sbin/mount and /bin/host holes from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

AIX4.1.4.0localrootusrsbinarpexploit AIX4.24.1LC_MESSEGASusrsbinmountexploit AIX4.2dttermexploit AIX4.2lquerylvexploit AIXHolesandExploits AIXLC_MESSAGESusrsbinmountandbinhostholes AIXMountExploit AIXXlock AIXdtactionandHOMEExploit AIXgethostbyname()andbinhostexploit.