Berkeley CSUA MOTD:Entry 20851
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2025/05/24 [General] UID:1000 Activity:popular
5/24    

2001/3/20 [Computer/SW/OS/Windows, Computer/SW/OS/Solaris] UID:20851 Activity:very high
3/19    So, i have discovered what i'm sure is a buffer overflow in
        an application server my company uses.  I can crash my server
        and send random stuff to the kernel.  However, I'm not a coder
        (just a Sys. Admin.) so i can't really determine which part of
        the garbage i'm sending gets executed.  If i had more foo,
        perhaps i could figure it out but...  My question is, who, if
        anyone, should i tell? (I am thinking of dropping everything
        and figuring out what i need to, just to see my name on a CERT.)
        \_ "fu", not "foo"
           \_ your fough is week, old man.
        \_ Which OS? I'm sure that if you're using Linux or {Free|Open|
           Net}BSD you could probably get a backtrace somehow. If you're
           using a comercial OS you won't be able to pin down the exact line
           number in the source code but you might be able to gather
           some amount of info that might be useful.
            \_ Solaris on a Sparc.
               \_ truss(1) is your friend.  But how do you know that you
                  can really execute arbitrary code?  Are you sure it's
                  more than DOS?  And is it a bug in the app server or
                  the applications themselves?
                   \_ I guess i don't know if it is a bug in the app
                      server or the app.  (that's a good point, i've
                      been giving our java guys too much credit).  I'm
                      convinced it is a bona-fide Buffer Overflow because
                      stress testing didn't just cause it to time-out or
                      crash, it effected everything.  BASH started saying
                      things like "cannot execute binary file" if i typed
                      hostname, exiting out of bash i'd get a "Sytax error
                      at line 1: ( unexpected" when i tried to do something
                      exotic like type "ls"  (basically "echo" was the only
                      \_ Wow.  Painful.  Is this BEA?
                         \_ No, believe it or not, this product is worse.
                            \_ Freeware?  or IBM?
                      \_ I'm guessing its IBM. They have lots of documented
                         buffer overflows.
                      command that worked).  I couldn't even log in from
                      the console.  I had to stop-A and reboot.
                      \_ You've made my day...  Mistaking process or VM
                         exhaustion for security hole...  That's 31337.
        \_ Sometimes people can't just jump above their heads. Get over it.
        \_ Find a copy of smashing the stack for fun and profit (just do
           a search on google).  Writing a buffer overflow isn't that hard.
           It shouldn't take more than an evening of work.
2025/05/24 [General] UID:1000 Activity:popular
5/24    

You may also be interested in these entries...
2010/2/8-18 [Computer/SW/Apps/Media, Computer/SW/Apps] UID:53695 Activity:kinda low
2/5     I like Adobe Flash. When written correctly, it scales along
        with your browser size. It looks consistent on every single
        browser. It is predictable. On the other hand, I'm not a big
        fan of CSS/HTML, which for the most part, look wildly different
        between browsers, and don't even work consistently or
        correctly at times. So why do so many people (like Steve Jobs)
	...
2009/10/27-11/3 [Computer/SW/Unix] UID:53475 Activity:nil
10/27   http://www.maxgames.com/play/flash-mind-reader.html
        how does this work?
        \_ sh -c 'for ((i=0;i<10;i++)); do for ((j=0;j<10;j++)); do echo "$i$j-(\
$i+$j)" | bc; done ; done' | uniq
        \_ bash -c 'for ((i=0;i<10;i++)); do for ((j=0;j<10;j++)); do echo "$i$j\
-($i+$j)" | bc; done ; done' | uniq
	...
2009/4/20-23 [Computer/SW/Database] UID:52876 Activity:nil
4/19    ORCL u SUNW = ORCL.
        What is Larry Ellison thinking? What is he going to do with a bunch of
        legacy Sun hardware that no one uses anymore, its fading workstation
        customer base, and open source Sun MySQL that doesn't even generate
        revenue? I really don't get all this acquisition business.
        \_ A lot of big companies still use big, fat Sun hardware. Or use
	...
2009/1/15-23 [Computer/SW/OS/OsX] UID:52398 Activity:nil
1/15    can any serious development be done on OSX that is not *for OSX*.
        i'll grant that ruby on rails has excellent tutorials for the mac.
        discuss:
        \_ What kind of serious development?  If you want to use the standard
           OSX ui then your ui code will be pretty much useless elsewhere,
           but that's why concepts like MVC are so important.  Otherwise
	...
2008/11/29-12/6 [Computer/SW/OS/FreeBSD, Computer/SW/OS/VM] UID:52129 Activity:moderate
11/29   I'm experimenting with virtualization, and as a poor college student
        I'm wondering what the best alternatives for virtualization are, and
        how best to cut my teeth on messing with non-linux platforms (or I
        guess interesting stuff on Linux would work too). Right now I've got
        FreeBSD7 running on KVM on my home computer (on a Core 2 Quad), and am
        somewhat at a loss as to how to use it. (More details: bridged
	...
2008/11/14-26 [Computer/SW/Languages/Java, Computer/SW/OS/Solaris] UID:51970 Activity:moderate
11/13   http://sfgate.com/cgi-bin/article.cgi?f=/n/a/2008/11/14/financial/f051352S72.DTL
        http://preview.tinyurl.com/6nngpm
        Sun Microsystems Inc. plans to cut up to 6,000 jobs, or 18 percent of
        its global work force, as sales of its high-end computer servers have
        collapsed.  The drastic move announced Friday highlights Sun's
        desperation to cut costs and survive as an independent company. Sun's
	...
2008/11/14-26 [Computer/SW/OS/Linux, Computer/SW/OS/Solaris] UID:51989 Activity:moderate
11/14   lulz why doesn't GOOG buy JAVA i mean SUN i mean whatever the hell they
        are these days.
        \_ Even GOOG isn't THAT stupid
           \_ Sorry, but WHY would Google do something like that? They
              run 99.2% Linux servers on the backend. They don't use
              Solaris for development. I mean, what does Sun have to
	...
2008/9/24-29 [Computer/SW/OS/Windows, Computer/SW/OS/Solaris] UID:51283 Activity:nil
9/24    Why is nscd going crazy?  DoS?
        \- back in the solaris say 2.5-2.6 era, it had both some bugs
           (some malformed nis maps made it go crazy) and architectural
           flaws in the IPC/door+threading mechanism. if you are running
           OS-recent, dunno, but you can trace it.
           \_ Yeah, I think it's just buggy.  I've restarted it, and it seems
	...
2008/4/3-9 [Computer/SW/Languages/Misc, Computer/SW/OS/Solaris] UID:49658 Activity:nil
4/3     Solaris experts: I've never played with ZFS. Does it have a native
        dump command a la ufsdump?
        \_ This might be what you are looking for:
           http://preview.tinyurl.com/2xqkda [sun - bigadmin]
	...
2008/3/30-4/6 [Computer/SW/OS/Solaris] UID:49614 Activity:nil
3/30    Question: I just deleted 60 GB of files from an 80 GB disk. The
        disk activity lights were blinking like crazy and I could hear the
        drive crunch while the data was deleted. This is under Solaris.
        Anyway, I think UNIX uses unlink() when files are deleted. Shouldn't
        it just update the free list on the superblock and call it a day?
        What is all the crunching about?
	...
2007/11/27-30 [Computer/SW/Languages/C_Cplusplus, Computer/SW/OS/Solaris] UID:48701 Activity:high
11/27   I'm using select to do a nonblocking check to see if a single socket
        has anything to read off it.  Problem is, I can have up to 12228
        file descriptors, and Linux fd_set only supports up to 4096.  Any idea
        what I can do about this?  (Or a better solution?) -jrleek
        \- 1. who are you
           2. i am busy this week and you didnt mention language
	...