CVE-2018-19518

University of Washington IMAP Toolkit 2007f on UNIX, as used in imapopen in PHP and other products, launches an rsh command by means of the imaprimap function in c-client/imap4r1.c and the tcpaopen function in osdep/unix/tcpunix.c without preventing argument injection, which might allow remote...

CVE-2018-19518

University of Washington IMAP Toolkit 2007f on UNIX, as used in imapopen in PHP and other products, launches an rsh command by means of the imaprimap function in c-client/imap4r1.c and the tcpaopen function in osdep/unix/tcpunix.c without preventing argument injection, which might allow remote...

CVE-2018-19518

University of Washington IMAP Toolkit 2007f on UNIX, as used in imapopen in PHP and other products, launches an rsh command by means of the imaprimap function in c-client/imap4r1.c and the tcpaopen function in osdep/unix/tcpunix.c without preventing argument injection, which might allow remote...

CVE-2018-19518

University of Washington IMAP Toolkit 2007f on UNIX, as used in imapopen in PHP and other products, launches an rsh command by means of the imaprimap function in c-client/imap4r1.c and the tcpaopen function in osdep/unix/tcpunix.c without preventing argument injection, which might allow remote...

php imap_open Remote Code Execution

The imapopen function within php, if called without the /norsh flag, will attempt to preauthenticate an IMAP session. On Debian based systems, including Ubuntu, rsh is mapped to the ssh binary. Ssh's ProxyCommand option can be passed from imapopen to execute arbitrary commands. While many custom...

rsh Unencrypted Cleartext Login

This remote host is running a rsh service. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...

Solaris - RSH Stack Clash Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Solaris RSH Stack Clash Privilege Escalation', 'Description' = %q This module exploits a vulnerability in RSH on unpatched Solaris systems which...

Solaris RSH Stack Clash Privilege Escalation Exploit

This Metasploit module exploits a vulnerability in RSH on unpatched Solaris systems which allows users to gain root privileges. The stack guard page on unpatched Solaris systems is of insufficient size to prevent collisions between the stack and heap memory, aka Stack Clash. This Metasploit modul...

Solaris RSH Stack Clash Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Solaris RSH Stack Clash Privilege Escalation', 'Description' = %q This module exploits a vulnerability in RSH on unpatched Solaris systems which...

Authentication flaw

If RSH service is enabled on Junos OS and if the PAM authentication is disabled, a remote unauthenticated attacker can obtain root access to the device. RSH service is disabled by default on Junos. There is no documented CLI command to enable this service. However, an undocumented CLI command...

CVE-2018-0052 Junos OS: Unauthenticated remote root access possible when RSH service is enabled

If RSH service is enabled on Junos OS and if the PAM authentication is disabled, a remote unauthenticated attacker can obtain root access to the device. RSH service is disabled by default on Junos. There is no documented CLI command to enable this service. However, an undocumented CLI command...

CVE-2018-0052

CVE-2018-0052 concerns Junos OS where, if RSH is enabled and PAM authentication is disabled, a remote unauthenticated attacker can obtain root access. RSH is disabled by default, and there is no documented CLI to enable it; an undocumented privileged command can enable RSH and disable PAM, exposi...

CVE-2018-0052: Improper Authentication

If RSH service is enabled on Junos OS and if the PAM authentication is disabled, a remote unauthenticated attacker can obtain root access to the device. RSH service is disabled by default on Junos. There is no documented CLI command to enable this service. However, an undocumented CLI command...

PT-2018-1753

Name of the Vulnerable Software and Affected Versions Junos OS versions 12.1X46 prior to 12.1X46-D77 Junos OS versions 12.3 prior to 12.3R12-S10 Junos OS versions 12.3X48 prior to 12.3X48-D75 Junos OS versions 14.1X53 prior to 14.1X53-D47 Junos OS versions 15.1 prior to 15.1R4-S9, 15.1R6-S6, 15.1...

DEBIAN-CVE-2017-17853

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging incorrect BPFRSH signed bounds calculations...

UBUNTU-CVE-2017-17853

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging incorrect BPFRSH signed bounds calculations...

PT-2017-15047

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.14.8 Description The issue allows local users to cause a denial of service, potentially resulting in memory corruption, by leveraging incorrect BPF RSH signed bounds calculations in the kernel/bpf/verifier.c fil...

Oracle Solaris 11.111.3 (RSH) - Stack Clash Local Privilege Escalation

Oracle Solaris 11.111.3 RSH - Stack Clash Local Privilege Escalation / Solarisrsh.c for CVE-2017-3630, CVE-2017-3629, CVE-2017-3631 Copyright C 2017 Qualys, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published ...

Solaris RSH Stack Clash Privilege Escalation

This module exploits a vulnerability in RSH on unpatched Solaris systems which allows users to gain root privileges. The stack guard page on unpatched Solaris systems is of insufficient size to prevent collisions between the stack and heap memory, aka Stack Clash. This module uploads and executes...

BruteSpray - Brute-Forcing from Nmap output (Automatically attempts default creds on found services)

BruteSpray takes nmap GNMAP output and automatically brute-forces services with default credentials using Medusa. BruteSpray can even find non-standard ports by using the -sV inside Nmap. Usage First do an nmap scan with '-oA nmap.gnmap'. Command: python brutespray.py -h Example: python...