about me

photo

I'm a software and IT security professional, with over 18 years of experience in IT industry. Currently, I work for Atende Software company on Multimedia & Security Division Director position, being responsible for development of the largest Polish content delivery network and a cloud-based DDoS mitigation service. I'm co-owner of Nette, a FTTH provider based in Lublin, Poland. Since 2003 I'm licensed ham radio operator (callsign SQ5JIV).

security research
2010 pseudofs local root vulnerability in freebsd 7.0 - 7.2 (exploit)
2009 my presentation from CONFidence 2009
devfs/kqueue local root vulnerability in freebsd <= 7.2 kernel (advisory)
pipe/kqueue local root vulnerability in freebsd <= 6.4 kernel (advisory)
fdesc/kqueue local root vulnerability in freebsd 6.0 - 6.1 kernel
exploit for proto_ops vulnerability in linux <= 2.6.30.4
2007 cooperation in delevopment of x86_64 ia32syscall exploit for linux
cooperation in development of dccp exploit for linux
2005 local root in ld.so on Solaris 8/9/10
vulnerabilities in traceroute on Solaris 10
missing NULL termination in rlogin on FreeBSD
research on undisclosed bugs in Nokia phones
2004 local off-by-one in mtr versions 0.55 to 0.65
remote information leak in Zyxel Prestige 681
multiple remote vulnerabilities in lukemftpd aka tnftpd, which is default on NetBSD and MacOS X
2003 remote DoS in tcpdump
research on remote root bug in wuftpd 2.6.2
2002 research on local root bug in sudo 1.6.5
trivial bug in mail on OpenBSD 3.0 gives local root in some circumstances
raw socket leak in mtr 0.45
2001 research on GnuPG having sgid root bit set on Mandrake
remote DoS in Zyxel Prestige 681 SDSL router
research on exploiting double free() bug in wuftpd 2.6.1
remote DoS in Mercury
local uid=uucp shell in hylafax
local root in FreeBSD 4.4 libutil
local root in FreeBSD 4.3 kernel (found by me and independently by Georgi Guninski, proof)
remote root in ftpd + libc from FreeBSD 4.2
remote root in ntpd 4.0.99k
remote root in QNX ftpd
remote root in mars_nwe 0.99.pl19
nonexploitable format string bugs in proftpd 1.2.0rc2
nonexploitable format string bugs in wuftpd 2.6.1
2000 local gid=kmem shell on FreeBSD 4
potential remote root bug in HPUX ftpd 1.7.212.2
remote root in wuftpd 2.6.0
local root in libterminfo and mtr 0.41 on FreeBSD 3.4
local uid=man shell in RH Linux 6.1
1999 local root in cfingerd 1.4.2
remote root in mars_nwe 0.99pl15
remote root in proftpd 1.2.0pre3
bug in FreeBSD 2.2.8 kernel and libc giving local root in some circumstances
remote DoS in Netware HTTP Server