[SECURITY] [DSA-316-1] New nethack packages fix buffer overflow, incorrect permissions

-------------------------------------------------------------------------- Debian Security Advisory DSA 316-1 [email protected] http://www.debian.org/security/ Matt Zimmerman June 11th, 2003 http://www.debian.org/security/faq -...

Linux kernel setgid implementation flaw

Hi, I believe the following to be accurate and of some interest to bugtraq readers, although i did not have time to extensively test it, nor did i warn the vendor, since 1 this is at most a undirect risk - IMHO - and 2 i am going on holidays so i had to balance betweeen disclosing now and letting...

CVE-2002-0498

Etnus TotalView 5.0.0-4 installs certain files with UID 5039 and GID 59, which could allow local users with that UID or GID to modify the files and gain privileges as other TotalView users...

Etnus TotalView 5.

Program: Etnus TotalView Version: 5.0.0-4 DESCRIPTION ----------- TotalView is a multiprocess source-level debugger for programs written in the C, C++, and Fortran programming languages. TotalView is part of a suite of programming tools from Etnus, LLC. PROBLEM ------- Failed to install the files...

[SECURITY] [DSA 079-2] New UUCP packages finally fix uucp uid/gid access

-------------------------------------------------------------------------- Debian Security Advisory DSA 079-2 [email protected] http://www.debian.org/security/ Martin Schulze February 8th, 2002 - -------------------------------------------------------------------------- Package : uucp...

Solaris_x86_mail_exploit.txt

Greetings, A few weeks ago I posted regarding an overflow in /usr/bin/mail on Solaris 2.7. I incorrectly stated that mail drops privs before the overflow occurs. Cheez Whiz, who wrote the shellcode, saw my post on Packetstorm and supplied the following information: ...The problem with your presen...

Important: Red Hat Security Advisory: : Updated man package fixing GID security problems.

Updated man packages fixing a local GID man exploit and a potential GID man to root exploit, as well as a problem with the man paths of Red Hat Linux 5.x and 6.x. Users could gain access to the GID man by overrunning a buffer in the ultimatesource function. Users with GID man could get root acces...

CVE-2001-0456

Summary: CVE-2001-0456 affects ProFTPD in Debian 2.2 where the postinst script fails to properly adjust the “run as uid/gid root” setting when anonymous access is enabled, causing the server to run with elevated privileges. What’s affected: proftpd on Debian 2.2 (potato); issue in post-install co...

CVE-1999-1413

Solaris 2.4 before kernel jumbo patch -35 allows set-gid programs to dump core even if the real user id is not in the set-gid group, which allows local users to overwrite or create files at higher privileges by causing a core dump, e.g. through dmesg...

CVE-1999-1413

Solaris 2.4 before kernel jumbo patch -35 allows set-gid programs to dump core even if the real user id is not in the set-gid group, which allows local users to overwrite or create files at higher privileges by causing a core dump, e.g. through dmesg...

CVE-1999-1413

Solaris 2.4 before patching, prior to the kernel jumbo patch -35, is vulnerable. Set-gid programs can dump core even if the real user is not in the set-gid group, enabling local privilege escalation through a core dump (e.g., via dmesg). The connected documents confirm the vulnerability details; ...

Multiple vendor 'Taylor UUCP' problems.

Brief description Due to incorrect argument handling in a component of the Taylor UUCP package, it is possible for local users to gain uid/gid uucp. This may allow further elevation, depending on the system, up to and including root access. On OpenBSD 2.8 and probably others it allows root...

RH7.0: man local gid 15 (man) exploit

======================================================== Vulnerable systems: redhat 7.0 with man-1.5h1-10 default package and earlier. ========================================================= Heap Based Overflow of man via -S option gives GID man. Due to a slight error in a length check, the -S...

Дырка в innfeed (buffer overflow)

Классическое переполнение буфера дает возможность получения uid news и возможно uid root пользователям имеющим gid news...

Solaris 2.52.67.08 - mailx -F Local Buffer Overflow (2)

Solaris 2.52.67.08 - mailx -F Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/2610/info Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and...

Slackware 7.1 /usr/bin/mail Local Exploit

Exploit for linux platform in category local exploits ========================================= Slackware 7.1 /usr/bin/mail Local Exploit ========================================= / Slackware 7.1 /usr/bin/Mail Exploit give gid=1 bin if /usr/bin/Mail is setgid but it is not setgid, setuid for...

Ports Security Advisory: FreeBSD-SA-01:22.dc20ctrl

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:22 Security Advisory FreeBSD, Inc. Topic: dc20ctrl port contains a locally exploitable buffer overflow yielding gid dialer Category: ports Module: dc20ctrl Announced:...

Kwintv - Local Buffer Overflow

Kwintv - Local Buffer Overflow / kwintv local buffer overflow. gid=video33 Author: Cody Tubbs loophole of hhp. www.hhp-programming.net / [email protected] 12/17/2000 For SuSE 7.0 - x86. sgid "video"33 by default. bash-2.04$ id uid=1000loophole gid=501noc bash-2.04$ ./b 0 Ret-addr 0xbfffe1fc,...

GnomeHack - Local Buffer Overflow

GnomeHack - Local Buffer Overflow / gnomehack local buffer overflow. gid=games60 Author: Cody Tubbs loophole of hhp. www.hhp-programming.net / [email protected] 12/17/2000 Tested on Debian 2.2, kernel 2.2.17 - x86. sgid "games"60 by default. bash-2.03$ id uid=1000loophole gid=501noc bash-2.03$ ....

Серьезная дырка в LPR (PostScript shell execution & grog)

При печати PostScript документов выполняются shell-команды содержащиеся в документах, при этом не сбрасывается egid lp, что позволяет получить gid lp, кроме того, в отдельных случаях возможно получить root используя некорректный вызов к программе pic в grog...