2538 matches found
solaris.chkperm+arp.txt
Greetings, OVERVIEW /usr/vmsys/bin/chkperm and /usr/sbin/arp can be used to read bin-owned files. BACKGROUND All my testing was done on Solaris 2.7 and 2.6 SPARC edition. DETAILS Vuln 1 - chkperm This one isn't nearly as interesting as the instant-shell variety. Here's how it works: chkperm is...
CVE-1999-0854
Ultimate Bulletin Board stores data files in the cgi-bin directory, allowing remote attackers to view the data if an error occurs when the HTTP server attempts to execute the file...
CVE-1999-0021
CVE-1999-0021 affects Count.cgi (wwwcount) CGI-bin; remote buffer overflow in handling QUERY_STRING enables arbitrary command execution. Impact is Web server context with the program’s privileges. Affected version(s) include Count.cgi 2.3; remediation per sources is to upgrade to version 2.4 or l...
sco_local_exploit.txt
Greetings, More SCO 5.0.x exploits, this time for scosession and scoterm. You'll only get egid=2bin out of scosession, but root for scoterm. Brock Tellier UNIX Systems Administrator Webley Systems www.webley.com --- scosessionx.c --- / SCO 5.0.x scosession local bin exploit sgid bin Will set...
win98explorer.txt
Date: Mon, 9 Feb 1998 17:49:45 -0800 From: Scott To: [email protected] Subject: Another Windows98 Bug... I'm not sure about the details of this problem, but when testing another buffer overflow, I created a long filename called "testfile.txt " note the chr160's at the end It is 235 characters ...
omnihttpd.webserver.txt
Date: Sat, 5 Jun 1999 09:53:51 +0300 From: Valentin Perelogin To: [email protected] Subject: Remote Exploit Bug in OmniHTTPd Web Server Hi all, The exploit bug will make temp files on the server until servers hdd is full. And anyone can do it remotely. By default visadmin.exe Visitor...
Web Server /cgi-bin Shell Access
The remote web server has one of these shells installed in /cgi-bin : ash, bash, csh, ksh, sh, tcsh, zsh Leaving executable shells in the cgi-bin directory of a web server may allow an attacker to execute arbitrary commands on the target machine with the privileges of the HTTP daemon. %NASLMINLEV...
Web Server /cgi-bin Perl Interpreter Access
The 'Perl' CGI is installed and can be launched as a CGI. This is equivalent to giving a free shell to an attacker, with the http server privileges usually root or nobody. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...
Verity Search97 2.1 - Security
Verity Search97 2.1 - Security source: https://www.securityfocus.com/bid/162/info A pair of vulnerabilities exist in Verity's Search97 web interface to the Verity search engine. The first vulnerability is due to cgi-bin scripts, s97cgi and s97rcgi failing to check for the existence of certain she...
Verity Search97 2.1 - Security
source: https://www.securityfocus.com/bid/162/info A pair of vulnerabilities exist in Verity's Search97 web interface to the Verity search engine. The first vulnerability is due to cgi-bin scripts, s97cgi and s97rcgi failing to check for the existence of certain shell meta characters. This allows...
SGI IRIX 6.4 - cgi-bin handler
SGI IRIX 6.4 - cgi-bin handler source: https://www.securityfocus.com/bid/380/info A vulnerability exists in the cgi-bin program 'handler', as included by Silicon Graphics in their Irix operating system. This vulnerability will allow a remote attacker to execute arbitrary commands on the vulnerabl...
Solaris 7.0 - 'chkperm' Local Privilege Escalation
source: https://www.securityfocus.com/bid/295/info Solaris 2.4, 2.5, and 2.5.1 possibly other versions have a package called FACE Framed Access Command Environment installed. Included in the package is a program called chkperm which checks a file to see if the user has permission to use the FACE...
Solaris 7.0 - Coredump File Write
Solaris 7.0 - Coredump File Write source: https://www.securityfocus.com/bid/296/info There is a vulnerability in the way Solaris 2.4 pre Jumbo Kernel Patch -35 for SPARC dumps core files. Under normal operation the operating system writes out a core image of a process when it is terminated due to...
Solaris 7.0 - 'Coredump' File Write
source: https://www.securityfocus.com/bid/296/info There is a vulnerability in the way Solaris 2.4 pre Jumbo Kernel Patch -35 for SPARC dumps core files. Under normal operation the operating system writes out a core image of a process when it is terminated due to the receipt of some signals. The...
CVE-1999-0509
Perl, sh, csh, or other shell interpreters are installed in the cgi-bin directory on a WWW site, which allows remote attackers to execute arbitrary commands...
PT-1996-1045 · Sh +2 · Sh +2
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned, however, the issue concerns systems with Perl, sh, csh, or other shell interpreters installed in the cgi-bin directory. Description: The issue allows remote attackers to execute arbitrary comman...
PT-1991-1012 · Sun · Sunos
Name of the Vulnerable Software and Affected Versions: SunOS versions 4.1.1 and earlier Description: A issue in the /bin/mail executable allows local users to gain root privileges through specific command line arguments. Recommendations: For SunOS versions 4.1.1 and earlier, at the moment, there ...