Linux Kernel 2.4 - SUID execve() System Call Race Condition Executable File Read

Linux Kernel 2.4 - SUID execve System Call Race Condition Executable File Read / source: https://www.securityfocus.com/bid/8042/info A race condition vulnerability has been discovered in the Linux execve system call, affecting the 2.4 kernel tree. The problem lies in the atomicity of placing a...

Linux Kernel 2.4 - SUID 'execve()' System Call Race Condition Executable File Read

/ source: https://www.securityfocus.com/bid/8042/info A race condition vulnerability has been discovered in the Linux execve system call, affecting the 2.4 kernel tree. The problem lies in the atomicity of placing a target executables file descriptor within the current process descriptor and...

CVE-2001-1185

CVE-2001-1185 affects FreeBSD 4.4. Some AIO operations may be delayed until after an execve call, allowing a local user to overwrite memory of the new process and gain privileges. The provided documents do not include exploitation details or remediation/fix information.

CVE-2001-1185: Undefined Security Weakness

Some AIO operations in FreeBSD 4.4 may be delayed until after a call to execve, which could allow a local user to overwrite memory of the new process and gain privileges...

FreeBSD 4.4 - AIO Library Cross Process Memory Write

FreeBSD 4.4 - AIO Library Cross Process Memory Write // source: https://www.securityfocus.com/bid/3661/info aio.h is a library implementing the POSIX standard for asynchronous I/O. Support for AIO may be enabled in FreeBSD by compiling the kernel with the VFSAIO option. This option is not enabled...

Security Advisory 2001-009: Race condition between sugid-exec and ptrace(2)

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2001-009 ================================= Topic: Race condition between sugid-exec and ptrace2 Version: All official releases up to and including 1.5 Severity: Local user may gain superuser privileges Fixed: NetBSD-current: June 15, 200...

reading from execve()ed setuid memory

Posted to bugzilla.redhat.com: Tue, 15 May 2001 06:43:27 -0400 This was then made unaccessable, and I've seen nothing that looks like a fix yet. A month and a half seems like long enough to work it out. Contents of https://bugzilla.redhat.com/bugzilla/showbug.cgi?id=40658 as posted before the pag...

execve of /bin/sh after setreuid(0,0)

Exploit for linux/x86 platform in category shellcode ===================================== execve of /bin/sh after setreuid0,0 ===================================== / $Id: execve-setreuid.c,v 1.1 2001/05/02 18:10:52 raptor Exp $ execve-setreuid.c v1.0 - shellcode for Linux/i386 Copyright c 2001...

execve of /bin/sh after setreuid0,0

execve of /bin/sh after setreuid0,0. Shellcode exploit for linx86 platform / $Id: execve-setreuid.c,v 1.1 2001/05/02 18:10:52 raptor Exp $ execve-setreuid.c v1.0 - shellcode for Linux/i386 Copyright c 2001 Raptor This shellcode does an execve of /bin/sh after a setreuid0, 0, then exits. / / ASM...

Linux Kernel 2.2.18 (RedHat 6.27.0 2.2.142.2.182.2.18ow4) - ptraceexecve Race Condition Privilege Escalation (2)

Linux Kernel 2.2.18 RedHat 6.27.0 2.2.142.2.182.2.18ow4 - ptraceexecve Race Condition Privilege Escalation 2 / source: https://www.securityfocus.com/bid/2529/info The Linux kernel is the core of all distributions of the Linux Operating System. It was originally written by Linus Torvalds, and is...

Linux Kernel 2.2.18 (RedHat 6.2/7.0 / 2.2.14/2.2.18/2.2.18ow4) - ptrace/execve Race Condition Privilege Escalation (2)

/ source: https://www.securityfocus.com/bid/2529/info The Linux kernel is the core of all distributions of the Linux Operating System. It was originally written by Linus Torvalds, and is maintained by a community of developers. A problem in the Linux Kernel could make it possible for a local user...

linux chroot()/execve() code

Exploit for linux/x86 platform in category shellcode ============================ linux chroot/execve code ============================ / This is Linux chroot/execve code.It is 80 bytes long.I have some ideas how to make it smaller, but till then use this one. signed predator linux registered use...

linux chroot/execve code

linux chroot/execve code. Shellcode exploit for linx86 platform / This is Linux chroot/execve code.It is 80 bytes long.I have some ideas how to make it smaller, but till then use this one. signed predator linux registered user : 181116 preedatoratsendmaildotru / char...

Linux/x86 - Audio (knock knock knock) via /dev/dsp + setreuid(0,0) + execve() Shellcode (566 bytes)

Linux/x86 - Audio knock knock knock via /dev/dsp + setreuid0,0 + execve Shellcode 566 bytes. Shellcode exploit for Linuxx86 platform / Audio knock knock knock via /dev/dsp + setreuid0,0 + execve shellcode. Linux x86 Author: Cody Tubbs loophole of hhp. www.hhp-programming.net / [email protected]...

linux/x86 execve /bin/sh toupper() evasion 55 bytes

Exploit for linux/x86 platform in category shellcode =================================================== linux/x86 execve /bin/sh toupper evasion 55 bytes =================================================== / Linux/x86 toupper evasion, standard execve /bin/sh used eg. in various imapd exploits...

linux/x86 execve /bin/sh toupper evasion 55 bytes

linux/x86 execve /bin/sh toupper evasion 55 bytes. Shellcode exploit for linx86 platform / Linux/x86 toupper evasion, standard execve /bin/sh used eg. in various imapd exploits. Goes through a loop adding 0x20 to the /bin/sh -= 0x20 string ie. yields /bin/sh after addition. / include char c0de = ...

CVE-1999-0674

CVE-1999-0674 affects the BSD profiling system call. A local user can modify the internal data space of a program via profiling and execve, with potential impact on confidentiality, integrity, and availability as noted in the sources. No remediation steps or concrete exploit details are provided ...

CVE-1999-0674: Undefined Security Weakness

The BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve...

2.2.12.execve.txt

From: [email protected] Subject: execve bug linux-2.2.12 While doing some debugging, I discovered a really nasty stack smash bug in linux-2.2.12. The I haven't checked previous versions of the 2.2 kernel but bug appears to be fixed in linux-2.2.13pre17. If I am reading this correctly, the...

NetBSD 1.4 OpenBSD 2.5 Solaris 7.0 - profil(2) Modify The Internal Data Space

NetBSD 1.4 OpenBSD 2.5 Solaris 7.0 - profil2 Modify The Internal Data Space / source: https://www.securityfocus.com/bid/570/info Some BSD's use a profil2 system call that dates back to "version 6" unix. This system call arranges for the kernel to sample the PC and increment an element of an array...