linux kmod/ptrace bug - details

Hello There are many discussions on slashdot for example on the recent linux ptrace & kmod bug. I'll try to clarify what is this all about. It's a local root vulnerability. It's exploitable only if: 1. the kernel is built with modules and kernel module loader enabled and 2...

Multiple bugs in Samba

Buffer overflow on SMB/CIFS packet re-assembly, chown race conditions...

DSA-232 cupsys - several vulnerabilities

Bulletin has no description...

CVE-2002-1366

Common Unix Printing System CUPS 1.1.14 through 1.1.17 allows local users with lp privileges to create or overwrite arbitrary files via file race conditions, as demonstrated by ice-cream...

CVE-2002-1366

Common Unix Printing System CUPS 1.1.14 through 1.1.17 allows local users with lp privileges to create or overwrite arbitrary files via file race conditions, as demonstrated by ice-cream...

Privelege escalation in util-linux chfn

Unchecked race conditions under file decriptors leaves ability to modify /etc/passwd...

Microsoft SQL Server 2000 - sp_MScopyscript SQL Injection

Microsoft SQL Server 2000 - spMScopyscript SQL Injection source: https://www.securityfocus.com/bid/5309/info The Microsoft SQL Server 2000 spMScopyscript stored procedure does not sufficiently validate input before passing it to the xpcmdshell extended stored procedure. An attacker with the abili...

Acrobat reader 4.05 temporary files

------------------------------------------------------------ Insecure temporary files in Acrobat Reader 4.05 [email protected] $Date: 2002/06/20 07:21:29 $ ------------------------------------------------------------ Author: Jarno Huuskonen [email protected] Discovered: Wed 18 Jul 2001...

*ALERT* BID 3581: Wu-Ftpd File Globbing Heap Corruption Vulnerability

--------------------------------------------------------------------------- Security Alert Subject: Wu-Ftpd File Globbing Heap Corruption Vulnerability BUGTRAQ ID: 3581 CVE ID: CVE-MAP-NOMATCH Published: Nov 27, 2001 Updated: Nov 28, 2001 01:12:56 Remote: Yes Local: No Availability: Always...

Security Update: [CSSA-2001-031.0] Linux -security issues in ucd-snmp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Caldera International, Inc. Security Advisory Subject: Linux - security issues in ucd-snmp Advisory number: CSSA-2001-031.0 Issue date: 2001, August 16 Cross reference: 1. Problem Description In a routine security audit of the ucd-snmp package we have...

Locally exploitable races in OpenBSD VFS

my apologies if it ends up submitted twice Let's start with the trivial: good old aliasing bugs. Example 1: dup2 vs. close. Relevant file: kern/kerndescrip.c sysdup2p, v, retval struct proc p; void v; registert retval; snip if uintold = fdp-fdnfiles || fdp-fdofilesold == NULL || uintnew =...

Unsafe Signal Handling in Sendmail

RAZOR advisory: Unsafe Signal Handling in Sendmail Issue Date: May 28, 2001 Contact: Michal Zalewski [email protected] Topic: Sendmail signal handlers used for dealing with specific signals are vulnerable to numerous race conditions. Affected Systems: Any systems running sendmail tested ...

CVE-2001-1349

Sendmail before 8.11.4, and 8.12.0 before 8.12.0.Beta10, allows local users to cause a denial of service and possibly corrupt the heap and gain privileges via race conditions in signal handlers...

OpenBSD 2.x 2.8 FTPd - glob() Remote Buffer Overflow

OpenBSD 2.x 2.8 FTPd - glob Remote Buffer Overflow // source: https://www.securityfocus.com/bid/2548/info The BSD ftp daemon and derivatives such as IRIX ftpd or the ftp daemon shipped with Kerberos 5 contain a number of buffer overflows that may lead to a compromise of root access to malicious...

Security Bulletin (MS00-057)

Microsoft Security Bulletin MS00-057 - -------------------------------------- Patch Available for "File Permission Canonicalization" Vulnerability Originally posted: August 10, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Microsoftr Internet...

Cisco Security Advisory: Cisco Secure PIX Firewall TCP Reset Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Cisco Secure PIX Firewall TCP Reset Vulnerability Revision 1.0 For Public Release 2000 July 11 06:00 US/Eastern UTC+0400 ------------------------------------------------------------------------ Summary ======= The Cisco Secure PIX Firewall cannot distinguish...

ACC/Ericsson Tigris Accounting Failure

The Tigris is a high-density router/remote-access platform, currently a product of Ericsson, more information on it can be found at: http://www.ericsson.com/datacom/products/wanaccess/tigris/index.shtml There appears to be a bug in the Tigris operating system software that causes Radius accountin...

Проблема генерации ключей в PGP 5.0

При определенных условиях в Unix-версиях используется фиксированная последовательность вместо случайной при генерации ключа...

linux_blind_tcp_spoof.txt

Subject: Linux blind TCP spoofing, act II + others To: [email protected] Hello, Thanks to libnids development, some features/bugs in Linux kernel were found. I notified kernel mantainers in May, but they didn't seem interested. 1. Blind TCP spoofing against 2.0.36/37 Let's label a Linux...

clearcase2.txt

Date: Tue, 9 Feb 1999 17:57:27 +0100 From: Oezguer Kesim To: [email protected] Subject: Re: L0pht Advisory - Rational Software ClearCase root exploitable race conditions Holla, things are even worse! You may want to remove the setuid flag from /usr/atria/etc/dbloader, but this won't fix the...