Lighttpd <= 1.4.16 FastCGI Header Overflow Remote Exploit

No description provided by source. / Remote Lighttpd + FastCGI + PHP example exploit Tested with Lighttpd 1.4.16 and PHP 5.2.4 To avoid abuse there's a remove me in the code. Example: ./exploit localhost 80 /etc/passwd or wget --referer=?php system'/usr/bin/id'; ? localhost ./exploit localhost 80...

nginx 0.6.x - Arbitrary Code Execution NullByte Injection

No description provided by source. Exploit Title: nginx Arbitrary Code Execution NullByte Injection Date: 24/08/2011 Exploit Author: Neal Poole Vendor Homepage: http://nginx.org/ Software Link: https://launchpad.net/nginx/0.6/0.6.36/+download/nginx-0.6.36.tar.gz Version: 0.5., 0.6., 0.7 = 0.7.65,...

Ubuntu 14.04 LTS : PHP updates (USN-2254-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2254-2 advisory. USN-2254-1 fixed vulnerabilities in PHP. The fix for CVE-2014-0185 further restricted the permissions on the PHP FastCGI Process Manager FPM UNIX socket. This...

Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2254-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2254-1 advisory. Christian Hoffmann discovered that the PHP FastCGI Process Manager FPM set incorrect permissions on the UNIX socket. A local attacker could use this issu...

USN-2254-1 php5 vulnerabilities

Christian Hoffmann discovered that the PHP FastCGI Process Manager FPM set incorrect permissions on the UNIX socket. A local attacker could use this issue to possibly elevate their privileges. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. CVE-2014-0185 Francisco...

USN-2254-1: PHP vulnerabilities

Christian Hoffmann discovered that the PHP FastCGI Process Manager FPM set incorrect permissions on the UNIX socket. A local attacker could use this issue to possibly elevate their privileges. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. CVE-2014-0185 Francisco...

openSUSE Security Update : FastCGI (openSUSE-2011-102)

added FastCGI-fixdeprecatedapi.patch: bnc735882 Fixes an issue where CGI.pm received CGI variables from previous requests. CVE-2011-2766 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE Security Update : FastCGI (openSUSE-SU-2012:0004-1)

This update fixes the following security issues : - 735882: FastCGI: bypass authentication CVE-2011-2766 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update FastCGI-5575. The text description of...

openSUSE Security Update : FastCGI (openSUSE-SU-2012:0004-1)

This update fixes the following security issues : - 735882: FastCGI: bypass authentication CVE-2011-2766 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update FastCGI-5575. The text description of...

Debian DSA-2943-1 : php5 - security update

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development : - CVE-2014-0185 The default PHP FPM socket permission has been changed from 0666 to 0660 to mitigate a security vulnerability CVE-2014-0185 in PHP FPM that allowed any...

DSA-2943-1 php5 - security update

Bulletin has no description...

Debian Security Advisory DSA 2943-1 (php5 - security update)

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development: CVE-2014-0185The default PHP FPM socket permission has been changed from 0666 to 0660 to mitigate a security vulnerability CVE-2014-0185 in PHP FPM that allowed any local...

U-Mail邮件系统普通用户权限getshell漏洞-2

简要描述： U-Mail邮件系统windows版本存在缺陷，导致普通用户getshell 详细说明： 环境说明：官网下载windows版最新版，windows server 2003+IIS6搭建、登录邮箱测试时候使用最新版chrome浏览器，需要普通用户登录 漏洞文件： C:\umail\WorldClient\html\client\option\module\oletterpaper.php 代码： if ACTION == "letterpaper-img-upload" $targetFolder = getusercachepath ; $verifyToken = md5...

PHP 5.4.x < 5.4.27, 5.5.x < 5.5.12 Privilege Escalation Vulnerability

PHP is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; ifdescription...

CVE-2014-0185

sapi/fpm/fpm/fpmunix.c in the FastCGI Process Manager FPM in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client...

Code injection

sapi/fpm/fpm/fpmunix.c in the FastCGI Process Manager FPM in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client...

CVE-2014-0185

sapi/fpm/fpm/fpmunix.c in the FastCGI Process Manager FPM in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client...

CVE-2014-0185

CVE-2014-0185 affects the PHP FastCGI Process Manager (FPM), specifically sapi/fpm/fpm/fpm_unix.c. It uses 0666 permissions on the UNIX socket in PHP versions before 5.4.28 and 5.5.x before 5.5.12, allowing local users to gain privileges via a crafted FastCGI client. Remediation: upgrade to PHP 5...

PT-2014-1304

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.28 PHP versions 5.5.x prior to 5.5.12 Description The issue is related to the FastCGI Process Manager FPM in PHP, where the sapi/fpm/fpm/fpm unix.c file uses 0666 permissions for the UNIX socket. This allows local use...

CVE-2014-0185: Improper Privilege Management

sapi/fpm/fpm/fpmunix.c in the FastCGI Process Manager FPM in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client...