CVE-2002-2003

The CVE-2002-2003 entry affects Compaq Tru64 systems: ypbind on Tru64 4.0F/4.0G/5.0A/5.1/5.1A allows a remote attacker to trigger a core dump by sending specific network packets generated by nmap. The connected records corroborate the core-dump impact and the network-based trigger across multiple...

CVE-2002-2003

ypbind in Compaq Tru64 4.0F, 4.0G, 5.0A, 5.1 and 5.1A allows remote attackers to cause the process to core dump via certain network packets generated by nmap...

CVE-2002-1914

dump 0.4 b10 through b29 allows local users to cause a denial of service execution prevention by using flock to lock the /etc/dumpdates file...

CVE-2002-1914

dump 0.4 b10 through b29 allows local users to cause a denial of service execution prevention by using flock to lock the /etc/dumpdates file...

CVE-2002-1914

CVE-2002-1914 concerns the dump utility (versions 0.4 b10 through b29). A local attacker can exploit a faulty flock() lock on /etc/dumpdates to cause a denial of service (execution prevention). Publicly noted references: RHSA-2005:583 and related advisories describe a patch/updates for the dump p...

security flaw

fs/exec.c in Linux 2.6, when one thread is tracing another thread that shares the same memory map, might allow local users to cause a denial of service deadlock by forcing a core dump when the traced thread is in the TASKTRACED state...

elfcd1.txt

!/bin/bash elfcd.sh warning: This code will crash your machine cat elfcd1.c / Linux binfmtelf core dump buffer overflow Copyright c 2005 iSEC Security Research. All Rights Reserved. THIS PROGRAM IS FOR EDUCATIONAL PURPOSES ONLY IT IS PROVIDED "AS IS" AND WITHOUT ANY WARRANTY. COPYING, PRINTING,...

security flaw

The elfcoredump function in binfmtelf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the createelftables function, causes a negative length argument to pass ...

Linux kernel ELF core dump privilege elevation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, since it became clear from the discussion in January about the uselib vulnerability, that the Linux community prefers full, non-embargoed disclosure of kernel bugs, I release full details right now. However to follows at least some of the...

Linux Kernel 2.2.x/2.3.x/2.4.x/2.5.x/2.6.x - ELF Core Dump Local Buffer Overflow (PoC)

/ source: https://www.securityfocus.com/bid/13589/info The Linux kernel is susceptible to a local buffer-overflow vulnerability when attempting to create ELF coredumps. This issue is due to an integer-overflow flaw that results in a kernel buffer overflow during a 'copyfromuser' call. To exploit...

CVE-2005-0824

The internaldump function in Mathopd before 1.5p5, and 1.6x before 1.6b6 BETA, when Mathopd is running with the -n option, allows local users to overwrite arbitrary files via a symlink attack on dump files that are triggered by a SIGWINCH signal...

CVE-1999-1574

CVE-1999-1574 concerns a buffer overflow in the lex routines of nslookup on AIX 4.3, which can cause a core dump and potentially allow arbitrary code execution via long input strings. Affected component: nslookup (AIX 4.3). Exploitation details are not explicitly described in the provided documen...

Dameware NT Utilities and MiniRemote Control <= 4.9 vulnerability

Dameware NT Utilities and MiniRemote Control = 4.9 vulnerability - 1 - Introduction DameWare NT Utilities is an enterprise system management application for Windows NT/2000/XP/2003 which provides an integrated collection of Microsoft Windows NT administration utilities incorporating a centralized...

[SA14524] Mathopd Insecure Dump File Creation Vulnerability

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: Mathopd Insecure Dump File Creation Vulnerability...

PT-2005-1853 · Mathopd · Mathopd

Name of the Vulnerable Software and Affected Versions: Mathopd versions 1.5p0 through 1.5p4 Mathopd versions 1.6x before 1.6b6 BETA Description: The issue allows local users to overwrite arbitrary files via a symlink attack on dump files triggered by a SIGWINCH signal when Mathopd is running with...

Ethereal <= 0.10.9 "3G-A11" Remote Buffer Overflow Exploit

Exploit for linux platform in category remote exploits ========================================================== Ethereal The CDMA2000 A11 protocol dissector packet-3g-a11.c has a stack overflow vulnerability when decoding Airlink records. This vulnerability was also discovered by Diego Giagio o...

Ethereal 0.10.9 (Linux) - '3G-A11' Remote Buffer Overflow

/ Ethereal 0.10.9 and below proof-of-concept remote root exploit c 2005 Diego Giagio The CDMA2000 A11 protocol dissector packet-3g-a11.c has a stack overflow vulnerability when decoding Airlink records. This vulnerability was also discovered by Diego Giagio on 01/March/2005. The vendor was...

[Full-disclosure] [ZH2005-02SA] Insecure tmp file creation in Wine

Title: Insecure tmp file creation in Wine Author: Giovanni Delvecchio e-mail: [email protected] Version affected : Wine 20050211 and previous releases About Wine ======= from http://www.winehq.org/site/docs/wine-faq/index : Wine is a program which allows the operation of DOS and MS Windows...

wine -- information disclosure due to insecure temporary file handling

Due to insecure temporary file creation in the Wine Windows emulator, it is possible for any user to read potentially sensitive information from temporary registry files. When a Win32 application is launched by wine, wine makes a dump of the Windows registry in /tmp with name regxxxxyyyy.tmp ,...

Aztek Forum <= 4.0 [myadmin.php] Database Dumper Exploit

Exploit for unknown platform in category web applications ======================================================== Aztek Forum include include include include include include include include include define REQ1 "/myadmin.php?action=exportindex&login=" define REQ2 " HTTP/1.1\nHost: " define REQ3...