Date: Fri, 10 May 2019 03:42:42 -0700 From: Qualys Security Advisory <qsa@...lys.com> To: oss-security@...ts.openwall.com Subject: Re: System Down: A systemd-journald exploit Hi all, Our systemd-journald exploit for CVE-2018-16865 and CVE-2018-16866 is now available at: https://www.qualys.com/2019/05/09/system-down/system-down.tar.gz It is also attached to this email. A few notes about this exploit: - It supports several targets by default (vulnerable versions of Debian, Ubuntu, Fedora, CentOS), and it should be relatively easy to add more targets. - When adding a new amd64 target, use the "free_hook" method if possible (if located at a multiple of 16 plus 8, as explained in our advisory); for various reasons, the alternative "stderr_chain" method is not as reliable as "free_hook" and may therefore take longer to succeed. - When adding and testing a new target, you may want to set "StartLimitInterval=1s" and "StartLimitBurst=10" (for example) in "systemd-journald.service": the exploit will detect this and brute-force faster. - If the exploit dies because "No journal files were opened due to insufficient permissions", the "wall" method can be used instead (via the "-w" switch). Our exploit currently implements the wall method "ssh 127.0.0.1", but alternative methods can be implemented ("utempter" and "gnome-pty-helper", for example). - To test the default information-leak method even if "No journal files were opened due to insufficient permissions", it is enough to create /var/log/journal/ (as explained in "man systemd-journald"). Thank you very much! With best regards, -- the Qualys Security Advisory team Download attachment "system-down.tar.gz" of type "application/gzip" (45694 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.