Vulnerabilities in KTH Kerberos IV

OVERVIEW Kerberos is a network authentication protocol which by using secret-key cryptography provides authentication over insecure networks. There are at least two common free Kerberos implementations: MIT and KTH Royal Institute of Techology, Sweden. The latter is included in OpenBSD and FreeBS...

IBM AIX 4.3.x - '/usr/lib/lpd/piobe' Local Buffer Overflow

/ source: https://www.securityfocus.com/bid/2037/info AIX is a variant of the UNIX Operating System, distributed by IBM. A problem exists which can allow a local user elevated priviledges. The problem exists in the piobe program. Due to the insuffient handling of the PIOSTATUSFILE, PIOTITLE, and...

CVE-2000-0963

Buffer overflow in ncurses library allows local users to execute arbitrary commands via long environmental information such as TERM or TERMINFODIRS...

PT-2000-1003 · Ncurses · Ncurses +1

Name of the Vulnerable Software and Affected Versions: ncurses versions 5.0 through 5.2 ncurses-devel versions 5.0 through 5.2 Description: The issue is related to a buffer overflow in the ncurses library, which can be exploited locally. This can lead to the execution of arbitrary commands via lo...

CVE-2000-1207

userhelper in the usermode package on Red Hat Linux executes non-setuid programs as root, which does not activate the security measures in glibc and allows the programs to be exploited via format string vulnerabilities in glibc via the LANG or LCALL environment variables CVE-2000-0844...

[SECURITY] New version of glibc released

Package: glibc Vulnerability: local exploit Debian-specific: no Recently two problems have been found in the glibc suite, which could be used to trick setuid applications to run arbitrary code. The first problem is the way ld.so handles environment variables: in order to provide a safe environmen...

[SECURITY] New version of glibc released

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman September 2, 2000 - ------------------------------------------------------------------------ Package: glibc Vulnerability: local...

cmctl_exp

! /usr/bin/ksh cmctl is installed setuid to Oracle by default. See BugTraq ID 170 and Oracle bug id 701297 and 714293. This script will create a setuid Oracle shell, /tmp/.sh redirect environment variables export ORACLEHOME=/tmp export ORAHOME=/tmp mkdir /tmp/bin chmod a+rx /tmp/bin create cmadmi...

[SECURITY] New version of mailx released

Package : mailx Problem type : local exploit Debian-specific: no mailx is a often used by other programs to send email. Unfortunately mailx as distributed in Debian GNU/Linux 2.1 has some features that made it possible to execute system commands if a user can trick a privileged program to send...

IRIX 5.2/5.3/6.x - TelnetD Environment Variable Format String

// source: https://www.securityfocus.com/bid/1572/info A vulnerability exists in the telnet daemon shipped with Irix versions 6.2 through 6.5.8, and in patched versions of the telnet daemon in Irix 5.2 through 6.1, from Silicon Graphics SGI. The telnetd will blindly use data passed by the user in...

Дырка в DBMAN

db.cgi позволяет получить атакующему некоторые переменные окружения...

Black Watch Labs Vulnerability Alert

Dear Security Professional, The following vulnerability: "Environment and Setup Variables Can Be Viewed Through DBMan db.cgi Script" is in the text of the message below and has just been posted to the Black Watch Labs Web site at http://www.perfectotech.com/blackwatchlabs/ Thank you, Black Watch...

PT-2000-1324 · Gossamer Threads · Gossamer Threads Dbman

Name of the Vulnerable Software and Affected Versions: Gossamer Threads DBMan version db.cgi Description: The issue allows remote attackers to view environmental variables and setup information. This is achieved by referencing a non-existing database in the db parameter. Recommendations: For...

CVE-1999-1587

/usr/ucb/ps in Sun Microsystems Solaris 8 and 9, and certain earlier releases, allows local users to view the environment variables and values of arbitrary processes via the -e option...

PT-1999-1002 · Sun Microsystems · Solaris

Name of the Vulnerable Software and Affected Versions: Sun Microsystems Solaris versions 8 and 9, and certain earlier releases Description: The issue is related to insufficient protection of sensitive data in the /usr/ucb/ps component of the Solaris operating system. This allows local users to vi...

CVE-1999-0073

Telnet allows a remote client to specify environment variables including LDLIBRARYPATH, allowing an attacker to bypass the normal system libraries and gain root access...

CVE-1999-0073

CVE-1999-0073 describes a vulnerability where a remote Telnet client can specify environment variables, including LD_LIBRARY_PATH, allowing an attacker to bypass normal system libraries and gain root access. The connected Red Hat, CVE, EUVD, and CVE list entries corroborate this description. The ...

unsetenv.txt

o unsetenv off-by-one error: The unsetenv function in glibc 2.1.1 suffers from a problem whereby when running through the environment variables, if the name of the variable being unset is present twice consecutively, the second is not destroyed. unsetenv is sometimes used by programs that depend ...

cron_bof.txt

Subject: Re: RHSA-1999:030-01 Buffer overflow in cron daemon To: [email protected] On Wed, 25 Aug 1999, Bill Nottingham wrote: To the best of our knowledge, no known exploits exist at this time. Also, it was possible to use specially formatted 'MAILTO' environment variables to send comman...

netscape-cache-exploit.txt

Below is source code for the two versions of the Netscape Cache exploit that was recently discovered by Dan Brumleve , as found on his web site at http://www.shout.net/nothing/cache-cow/index.html First version , and then second version listed. -----snip----- !/usr/bin/perl cache-cow.cgi -- Dan...