Re: [Full-Disclosure] Linux kernel brk() log reports

[David Hane <dlhane@sbcglobal.net>]

On Thursday 04 December 2003 13:18, Wojciech Purczynski wrote:
> > I am using logcheck to report unusual system events on several systems.
> > I was wondering if anyone could give me an example of a log message
> > showing an attempt to make use this exploit? I would like to put a
> > sample in my logcheck.hacking file.
>
> It depends on what exploit code may have been used. However, the bug may
> be exploited without leaving any traces...

I understand this. But anything is better than nothing. Still waiting to 
update a couple of kernels...


>
> > I assume some of you have tested the 2 recent exploits so you might have
> > some examples around.
>
> If you get some, could you send me a copy? ;)

I believe both were posted to Full Disclosure. They aren't pretty and may not 
work but it would be interersting to see what kind of log messages they 
generate.  Julien TINNES posted one. I forget who posted the other.

Dave

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html