Locally exploitable races in OpenBSD VFS

my apologies if it ends up submitted twice Let's start with the trivial: good old aliasing bugs. Example 1: dup2 vs. close. Relevant file: kern/kerndescrip.c sysdup2p, v, retval struct proc p; void v; registert retval; snip if uintold = fdp-fdnfiles || fdp-fdofilesold == NULL || uintnew =...

CVE-2001-1047

Race condition in OpenBSD VFS allows local users to cause a denial of service kernel panic by 1 creating a pipe in one thread and causing another thread to set one of the file descriptors to NULL via a close, or 2 calling dup2 on a file descriptor in one process, then setting the descriptor to NU...

CVE-2000-1040

CVE-2000-1040 concerns a format string vulnerability in the logging function of ypbind 3.3 when run in debug mode. The flaw can leak file descriptors and allow a denial of service. Some sources (Mandrake MDKSA-2000:064) also mention a related buffer overflow in ypserv if the build system lacks vs...

CVE-2000-0786

GNU userv 1.0.0 and earlier does not properly perform file descriptor swapping, which can corrupt the USERVGROUPS and USERVGIDS environmental variables and allow local users to bypass some access restrictions...

CVE-2000-0786

GNU userv 1.0.0 and earlier does not properly perform file descriptor swapping, which can corrupt the USERVGROUPS and USERVGIDS environmental variables and allow local users to bypass some access restrictions...

CVE-2000-0786

GNU userv 1.0.0 and earlier are affected by an issue where improper file descriptor swapping can corrupt the USERV_GROUPS and USERV_GIDS environment variables, potentially allowing local users to bypass some access restrictions. The public documentation identifies the affected component and the c...

ftpd.dos.pl

Who has more free file descriptors & network ports, you or the ftp server ? ftpd's which limit connections to 1 per user@host or similar may have some defense against this, or if they don't support multiple data connections open at the same time. I suspect "many" is the number of ftpd's which are...

ISC BIND 8.2.2 IRIX 6.5.17 Solaris 7.0 - NXT Overflow Denial of Service

ISC BIND 8.2.2 IRIX 6.5.17 Solaris 7.0 - NXT Overflow Denial of Service // source: https://www.securityfocus.com/bid/788/info There are several vulnerabilities in recent BIND packages pre 8.2.2. The first is a buffer overflow condition which is a result of BIND improperly validating NXT records...

ISC BIND 8.2.2 / IRIX 6.5.17 / Solaris 7.0 - NXT Overflow / Denial of Service

// source: https://www.securityfocus.com/bid/788/info There are several vulnerabilities in recent BIND packages pre 8.2.2. The first is a buffer overflow condition which is a result of BIND improperly validating NXT records. The consequence of this being exploited is a remote root compromise...

CVE-1999-0062

The OpenBSD chpass command is affected by a local-privilege-escalation flaw caused by file-descriptor leakage, enabling a local user to gain root access. The provided documents do not specify affected versions, exact root-cause details, exploit steps, or available fixes. No exploitation workflow ...

CVE-1999-0083

CVE-1999-0083 corresponds to a getcwd() file descriptor leak in FTP. The available connected data identifies the vulnerability as a leak in the getcwd() call within FTP, but no exploit details are provided. CVSS 2.0 metrics indicate a Network attack vector, Low attack complexity, no authenticatio...

CVE-1999-0083

getcwd file descriptor leak in FTP...

FreeBSD 3.0 - UNIX-domain Panic (Denial of Service)

FreeBSD 3.0 - UNIX-domain Panic Denial of Service / source: https://www.securityfocus.com/bid/168/info A vulnerability in FreeBSD's UNIX-domain protocol implementation of file descriptor passing can cause the kernel to panic. / include include include include include include define PATH "/tmp/123...

FreeBSD 3.0 - UNIX-domain Panic (Denial of Service)

/ source: https://www.securityfocus.com/bid/168/info A vulnerability in FreeBSD's UNIX-domain protocol implementation of file descriptor passing can cause the kernel to panic. / include include include include include include define PATH "/tmp/123" define PATHTMP "/tmp/123.tmp" define SOMEFILE...

CVE-1999-0062

The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage...

CVE-1999-0083

getcwd file descriptor leak in FTP...

PT-1997-1042 · Sgi · Irix

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns a file descriptor leak in the getcwd function when using FTP. Recommendations: At the moment, there is no information about a newer version that contains a fix fo...