SCO OpenServer 5.0.6 - lpadmin Buffer Overflow

SCO OpenServer 5.0.6 - lpadmin Buffer Overflow source: https://www.securityfocus.com/bid/2553/info SCO OpenServer 5.0.6 and possibly earlier versions ships with several suid 'bin' executables used in printer administration and related tasks. This includes lpadmin, a component used to manage and...

Aspseek Buffer Overflow

|---------------------------------------------------------------------------------------| / Product: Aspseek Search Engine. Vendor URL: www.aspseek.org / Tested on: v1.0.0 - v1.0.3 Freeware Linux Vendor Contact: Mailed on 8th March NO Reply Vendor Patched though / |-- The Problem,...

Slackware 7.1 /usr/bin/mail Local Exploit

Exploit for linux platform in category local exploits ========================================= Slackware 7.1 /usr/bin/mail Local Exploit ========================================= / Slackware 7.1 /usr/bin/Mail Exploit give gid=1 bin if /usr/bin/Mail is setgid but it is not setgid, setuid for...

Slackware 7.1 - usrbinmail Local Privilege Escalation

Slackware 7.1 - usrbinmail Local Privilege Escalation / Slackware 7.1 /usr/bin/Mail Exploit give gid=1 bin if /usr/bin/Mail is setgid but it is not setgid, setuid for default. tested on my box sl 7.1 crazy exploited by kengz. GID.... \x01 = 1 bin \x02 = 2 , \x03 = 3 , ... \x0a = 10 \x0b = 11 .......

Tru64 UNIX 4.0g /usr/bin/at Local Root Exploit

Exploit for tru64 platform in category local exploits ============================================== Tru64 UNIX 4.0g /usr/bin/at Local Root Exploit ============================================== / Tru64 UNIX 4.0g JAVA /usr/bin/at local root exploit. ALPHA Author: Cody Tubbs loophole of hhp. Site:...

Solaris 2.62.7 - usrbinwrite Local Overflow

Solaris 2.62.7 - usrbinwrite Local Overflow include include / /usr/bin/write overflow proof of conecpt. Tested on Solaris 7 x86 Pablo Sor, Buenos Aires, Argentina. 01/2000 [email protected] usage: write-exp shelloffset retaddroffset default offset should work. / long getesp asm"movl %esp,%eax"; ch...

CVE-2000-0868: Undefined Security Weakness

The default configuration of Apache 1.3.12 in SuSE Linux 6.4 allows remote attackers to read source code for CGI scripts by replacing the /cgi-bin/ in the requested URL with /cgi-bin-sdb/...

HP-UX 11.0 - bincu Local Privilege Escalation

HP-UX 11.0 - bincu Local Privilege Escalation / Copyright c 2001 Zorgon All Rights Reserved The copyright notice above does not evidence any actual or intended publication of such source code. HP-UX /bin/cu exploit. Tested on HP-UX 11.00 [email protected] http://www.nightbird.free.fr / includ...

HP-UX 11.0 - '/bin/cu' Local Privilege Escalation

/ Copyright c 2001 Zorgon All Rights Reserved The copyright notice above does not evidence any actual or intended publication of such source code. HP-UX /bin/cu exploit. Tested on HP-UX 11.00 [email protected] http://www.nightbird.free.fr / include include include include define LEN 9778 defi...

CVE-2000-1225: Undefined Security Weakness

Xitami 2.5b installs the testcgi.exe program by default in the cgi-bin directory, which allows remote attackers to gain sensitive configuration information about the web server by accessing the program...

GLIBC - '/bin/su' Local Privilege Escalation

/ Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of /bin/su program with the address of the shellcode, so, the program executes it when main returns or exit is called Thanks a lot to rwxrwxrwx for explaining me this technique...

CVE-2000-0703: Undefined Security Weakness

suidperl aka sperl does not properly cleanse the escape sequence "!" before calling /bin/mail to send an error report, which allows local users to gain privileges by setting the "interactive" environmental variable and calling suidperl with a filename that contains the escape sequence...

linux/x86 break chroot setuid0 + /bin/sh 132 bytes

linux/x86 break chroot setuid0 + /bin/sh 132 bytes. Shellcode exploit for linx86 platform / Linux/x86 - setreuid0, 0; - chroot-break make a temp dir with mkdir, chroot to tempdir, go through a loop of chdir".."; then a final chroot"."; - execve of /bin/sh used in several wu-ftpd, beroftpd and...

Дырка в AnalogX Simple Server

Запрос к длинному имени файла в каталоге cgi-bin приводит к краху сервера...

CVE-2000-0473

Buffer overflow in AnalogX SimpleServer 1.05 allows a remote attacker to cause a denial of service via a long GET request for a program in the cgi-bin directory...

CVE-2000-0473: Undefined Security Weakness

Buffer overflow in AnalogX SimpleServer 1.05 allows a remote attacker to cause a denial of service via a long GET request for a program in the cgi-bin directory...

CVE-2000-0473

Buffer overflow in AnalogX SimpleServer 1.05 allows a remote attacker to cause a denial of service via a long GET request for a program in the cgi-bin directory...

CVE-1999-0854

Ultimate Bulletin Board stores data files in the cgi-bin directory, allowing remote attackers to view the data if an error occurs when the HTTP server attempts to execute the file...

CVE-2000-0169: Undefined Security Weakness

Batch files in the Oracle web listener ows-bin directory allow remote attackers to execute commands via a malformed URL that includes '?&'...

CVE-1999-0854: Undefined Security Weakness

Ultimate Bulletin Board stores data files in the cgi-bin directory, allowing remote attackers to view the data if an error occurs when the HTTP server attempts to execute the file...