2727 matches found
simpleinit root exploit - file descriptor left open
Background ---------- Simpleinit is an init program for Linux systems. It is included in the util-linux distribution. More information about simpleinit is available at http://www.atnf.csiro.au/people/rgooch/linux/boot-scripts/. Problem ------- Simpleinit leaves a file descriptor open in some chil...
Privelege escalation via simpleinit
File descriptor doesn't closed after priveleges are dropped...
Richard Gooch SimpleInit 2.0.2 - Open File Descriptor
// source: https://www.securityfocus.com/bid/5001/info A vulnerability has been reported for simpleinit that may allow users to execute arbitrary commands as the superuser. The vulnerability occurs because simpleinit may allow some child processes to inherit a file descriptor with read-write...
Richard Gooch SimpleInit 2.0.2 - Open File Descriptor
Richard Gooch SimpleInit 2.0.2 - Open File Descriptor // source: https://www.securityfocus.com/bid/5001/info A vulnerability has been reported for simpleinit that may allow users to execute arbitrary commands as the superuser. The vulnerability occurs because simpleinit may allow some child...
CVE-2002-0572
FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, allows local users to write to or read from restricted files by closing the file descriptors 0 standard input, 1 standard output, or 2 standard error, which may then be reused by a called setuid process that intended to...
OpenBSD kernel fails to properly check closed file descriptors "0-2" when running setuid program
Overview The OpenBSD kernel does not adequately check file descriptors 0-2 prior to execing setuid binaries. Other OS kernels may be vulnerable as well. Description The OpenBSD kernel does not adequately check file descriptors 0-2 prior to execing setuid binaries. As a result, an attacker may be...
OpenBSD local DoS and root exploit
The following is research material from FozZy from Hackademy and Hackerz Voice newspaper http://www.hackerzvoice.org, and can be distributed modified or not if proper credits are given to them. For educational purposes only, no warranty of any kind, I may be wrong, this post could kill you mail...
Apple Mac OSX 10.x / FreeBSD 4.x / OpenBSD 2.x / Solaris 2.5/2.6/7.0/8 - 'exec C Library' Standard I/O File Descriptor Closure
/ source: https://www.securityfocus.com/bid/4568/info It has been reported that BSD-based kernels do not check to ensure that the C library standard I/O file descriptors 0-2 are valid open files before execing setuid images. Consequently, I/O that are opened by a setuid process may be assigned fi...
Security Advisory FreeBSD-SA-02:23.stdio
-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:23.stdio Security Advisory The FreeBSD Project Topic: insecure handling of stdio file descriptors Category: core Module: kernel Announced: 2002-04-22 Credits: Joost Pol...
CVE-2001-1047
Race condition in OpenBSD VFS allows local users to cause a denial of service kernel panic by 1 creating a pipe in one thread and causing another thread to set one of the file descriptors to NULL via a close, or 2 calling dup2 on a file descriptor in one process, then setting the descriptor to NU...
Locally exploitable races in OpenBSD VFS
my apologies if it ends up submitted twice Let's start with the trivial: good old aliasing bugs. Example 1: dup2 vs. close. Relevant file: kern/kerndescrip.c sysdup2p, v, retval struct proc p; void v; registert retval; snip if uintold = fdp-fdnfiles || fdp-fdofilesold == NULL || uintnew =...
CVE-2001-1047
Race condition in OpenBSD VFS allows local users to cause a denial of service kernel panic by 1 creating a pipe in one thread and causing another thread to set one of the file descriptors to NULL via a close, or 2 calling dup2 on a file descriptor in one process, then setting the descriptor to NU...
CVE-2000-1040
CVE-2000-1040 concerns a format string vulnerability in the logging function of ypbind 3.3 when run in debug mode. The flaw can leak file descriptors and allow a denial of service. Some sources (Mandrake MDKSA-2000:064) also mention a related buffer overflow in ypserv if the build system lacks vs...
CVE-2000-0786
GNU userv 1.0.0 and earlier does not properly perform file descriptor swapping, which can corrupt the USERVGROUPS and USERVGIDS environmental variables and allow local users to bypass some access restrictions...
CVE-2000-0786
GNU userv 1.0.0 and earlier are affected by an issue where improper file descriptor swapping can corrupt the USERV_GROUPS and USERV_GIDS environment variables, potentially allowing local users to bypass some access restrictions. The public documentation identifies the affected component and the c...
CVE-2000-0786
GNU userv 1.0.0 and earlier does not properly perform file descriptor swapping, which can corrupt the USERVGROUPS and USERVGIDS environmental variables and allow local users to bypass some access restrictions...
ftpd.dos.pl
Who has more free file descriptors & network ports, you or the ftp server ? ftpd's which limit connections to 1 per user@host or similar may have some defense against this, or if they don't support multiple data connections open at the same time. I suspect "many" is the number of ftpd's which are...
ISC BIND 8.2.2 IRIX 6.5.17 Solaris 7.0 - NXT Overflow Denial of Service
ISC BIND 8.2.2 IRIX 6.5.17 Solaris 7.0 - NXT Overflow Denial of Service // source: https://www.securityfocus.com/bid/788/info There are several vulnerabilities in recent BIND packages pre 8.2.2. The first is a buffer overflow condition which is a result of BIND improperly validating NXT records...
ISC BIND 8.2.2 / IRIX 6.5.17 / Solaris 7.0 - NXT Overflow / Denial of Service
// source: https://www.securityfocus.com/bid/788/info There are several vulnerabilities in recent BIND packages pre 8.2.2. The first is a buffer overflow condition which is a result of BIND improperly validating NXT records. The consequence of this being exploited is a remote root compromise...