[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 10 May 2019 03:42:42 -0700
From: Qualys Security Advisory <qsa@...lys.com>
To: oss-security@...ts.openwall.com
Subject: Re: System Down: A systemd-journald exploit
Hi all,
Our systemd-journald exploit for CVE-2018-16865 and CVE-2018-16866 is
now available at:
https://www.qualys.com/2019/05/09/system-down/system-down.tar.gz
It is also attached to this email. A few notes about this exploit:
- It supports several targets by default (vulnerable versions of Debian,
Ubuntu, Fedora, CentOS), and it should be relatively easy to add more
targets.
- When adding a new amd64 target, use the "free_hook" method if possible
(if located at a multiple of 16 plus 8, as explained in our advisory);
for various reasons, the alternative "stderr_chain" method is not as
reliable as "free_hook" and may therefore take longer to succeed.
- When adding and testing a new target, you may want to set
"StartLimitInterval=1s" and "StartLimitBurst=10" (for example) in
"systemd-journald.service": the exploit will detect this and
brute-force faster.
- If the exploit dies because "No journal files were opened due to
insufficient permissions", the "wall" method can be used instead (via
the "-w" switch). Our exploit currently implements the wall method
"ssh 127.0.0.1", but alternative methods can be implemented
("utempter" and "gnome-pty-helper", for example).
- To test the default information-leak method even if "No journal files
were opened due to insufficient permissions", it is enough to create
/var/log/journal/ (as explained in "man systemd-journald").
Thank you very much! With best regards,
--
the Qualys Security Advisory team
Download attachment "system-down.tar.gz" of type "application/gzip" (45694 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
