d_path() truncating excessive long path name vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Name: Linux kernel Version: up to 2.2.20 and 2.4.18 Homepage: http://www.kernel.org/ Author: Wojciech Purczynski [email protected] Date: March 26, 2002 Issue: ====== In case of excessively long path names dpath kernel internal function returns truncated...

PT-2001-2644 · Openbsd · Openbsd

Name of the Vulnerable Software and Affected Versions: OpenBSD versions 2.9 through 3.0 Description: The issue allows local users to cause a denial of service and trigger a null dereference due to the uipc system calls providing user mode return instead of kernel mode values to the fdrelease...

CVE-2001-1253

Alexis 2.0 and 2.1 in COM2001 InternetPBX stores voicemail passwords in plain text in the com2001.ini file, which could allow local users to make long distance calls as other users...

CVE-1999-1493

Vulnerability in crp in Hewlett Packard Apollo Domain OS SR10 through SR10.3 allows remote attackers to gain root privileges via insecure system calls, 1 pad$dmcmd and 2 pad$defpfk...

CVE-1999-1493

The CVE-1999-1493 entry describes a vulnerability in the crp component of Hewlett Packard Apollo Domain OS SR10 through SR10.3. It allows remote attackers to gain root privileges via insecure system calls, specifically pad_$dm_cmd and pad_$def_pfk(). The provided documents do not include concrete...

CVE-1999-1086

CVE-1999-1086 affects Novell NetWare 5 and earlier when running over IPX with a packet signature level

CVE-1999-1493: Undefined Security Weakness

Vulnerability in crp in Hewlett Packard Apollo Domain OS SR10 through SR10.3 allows remote attackers to gain root privileges via insecure system calls, 1 pad$dmcmd and 2 pad$defpfk...

xxman.sh

xman doesn't drop privileges anywheres in the program. but, does support suid installation. so, exploiting via a system call is much easier than the buffer overflow in MANPATH, mentioned in another bugtraq posting. here is an example of such an exploitation possibility: -- xxman.sh -- !/bin/sh...

Unsafe Signal Handling in Sendmail

RAZOR advisory: Unsafe Signal Handling in Sendmail Issue Date: May 28, 2001 Contact: Michal Zalewski [email protected] Topic: Sendmail signal handlers used for dealing with specific signals are vulnerable to numerous race conditions. Affected Systems: Any systems running sendmail tested ...

CVE-1999-0923

CVE-1999-0923 affects ColdFusion Server 4.0 through sample runnable code snippets that allow remote attackers to read files, cause a denial of service, or use the server as a proxy for other HTTP calls. The description indicates impact on confidentiality, integrity, and availability (partial C/I/...

CVE-2000-0276

BeOS 4.5 and 5.0 allow local users to cause a denial of service via malformed direct system calls using interrupt 37...

CVE-2000-0276

BeOS 4.5 and 5.0 are affected by CVE-2000-0276: local users can cause a denial of service through malformed direct system calls using interrupt 37. The vulnerability is described as affecting BeOS versions 4.5 and 5.0, with a partial impact on availability. The provided documents do not detail ex...

CVE-2000-0276: Undefined Security Weakness

BeOS 4.5 and 5.0 allow local users to cause a denial of service via malformed direct system calls using interrupt 37...

ml2 - Local users can Crash processes

ml2 - Local users can Crash processes include include include include error int mainint argc, char argv char foo1000; char bigmsg10000; char s, holds; int i = 0; memsetbigmsg, 'X', sizeofbigmsg-1; if argc \n", argv0; exit1; // fork; memsetfoo, 0, sizeoffoo; snprintffoo, sizeoffoo, "/proc/%s/stat"...

(SRADV00006) Remote command execution vulnerabilities in phpGroupWare

================================================= Secure Reality Pty Ltd. Security Advisory 6 SRADV00006 http://www.securereality.com.au ================================================= Title Remote command execution vulnerabilities in phpGroupWare Released 6/11/2000 Vulnerable Versions below...

BSD Passive Connection Shellcode

BSD Passive Connection Shellcode. Shellcode exploit for bsd platform ; Passive Connection Shellcode ; ; Coded by Scrippie - [email protected] - http://b0f.freebsd.lublin.pl ; Buffer0verfl0w Security ; Why? This evades firewalls... ; ; YES, this is for NASM, I detest AT&T syntaxis - it's gross and...

BSD Passive Connection Shellcode

Exploit for bsd platform in category shellcode ================================ BSD Passive Connection Shellcode ================================ ; Passive Connection Shellcode ; ; Coded by Scrippie - email protected - http://b0f.freebsd.lublin.pl ; Buffer0verfl0w Security ; Why? This evades...

Format strings: bug #2: LPRng

Hi, SUMMARY ------- LPRng is almost certainly vulnerable to remote-root compromise on account of a format string bug. The flaw is almost identical to the rpc.statd one I found; namely a faulty syslog wrapper. This is becoming a very common flaw. Details ------- Here is a code excerpt from:...

Format strings: bug #1: BSD-lpr

Hi, INTRO ----- Welcome to a short series of security bugs, all involving mistakes with "user supplied format strings". This class of bug is very popular on Bugtraq at the moment, so what an ideal time for a few examples. BSD-lpr ------- If we look into lpr/lpd/printjob.c, we can find the followi...

CVE-2000-0456

NetBSD CVE-2000-0456 affects NetBSD 1.4.2 and earlier. The vulnerability stems from certain kernel system calls that do not yield the CPU, allowing local users to cause a denial of service (cpu-hog). The NVD/metrics indicate a low severity (CVSS v2 base score 2.1) with local attack vector and no ...