glibc-2.2 and openssh-2.3.0p1 exploits glibc >= 2.1.9x

Exploit for linux platform in category local exploits ====================================================== glibc-2.2 and openssh-2.3.0p1 exploits glibc = 2.1.9x ====================================================== Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This...

glibc-2.2 openssh-2.3.0p1 glibc 2.1.9x - File Read

glibc-2.2 openssh-2.3.0p1 glibc 2.1.9x - File Read Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to...

glibc-2.2 / openssh-2.3.0p1 / glibc 2.1.9x - File Read

Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to read echo "$ssh" echo " Checking permisions..." if...

CVE-2000-0824

The CVE-2000-0824 issue involves glibc 2.1.1 unsetenv(): when a variable appears twice in the environment, the value may not be properly removed, enabling a local attacker to influence setuid programs with duplicate variables (e.g., LD_PRELOAD, LD_LIBRARY_PATH) and potentially execute code as roo...

CVE-2000-0824

The unsetenv function in glibc 2.1.1 does not properly unset an environmental variable if the variable is provided twice to a program, which could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables such as LDPRELOAD or...

CVE-2000-0824: Undefined Security Weakness

The unsetenv function in glibc 2.1.1 does not properly unset an environmental variable if the variable is provided twice to a program, which could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables such as LDPRELOAD or...

[RHSA-2001:001-05] glibc file read or write access local vulnerability

--------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: glibc file read or write access local vulnerability Advisory ID: RHSA-2001:001-05 Issue date: 2001-01-11 Updated on: 2001-01-11 Product: Red Hat Linux Keywords: glibc...

Серьезная дырка в glibc

В suid-приложениях не сбрасывается переменная RESOLVHOSTCONF, что позволяет пользователю указать в качестве конфигурации резолвера любой файл, получить доступ на чтение к любому файлу. Кроме того, в отдельных случаях пользователь может подключать свои библиотеки...

Glibc Local Root Exploit

Hi all, This has been bouncing around on vuln-dev and the debian-devel lists. It effects glibc = 2.1.9x and it would seem many if not all OSes using these versions of glibc. Ben Collins writes, "This wasn't supposed to happen, and the actual fix was a missing comma in the list of secure env vars...

glibc 2.2 local vulnerability on setuid binaries

glibc-2.2 contains a local vulnerability that affects all setuid root binaries. Any user on affected systems will be able to read any file on the system through a simple process: The user sets the RESOLVHOSTCONF environment variable to the name of the file that they wish to read, then runs any...

mount exploit for glibc locale bug

Exploit for linux platform in category local exploits ================================== mount exploit for glibc locale bug ================================== / mount exploit for glibc locale bug tested on redhat 6.2 and slackware 7.0 and debian 2.2 Debian 2.2 mount-2.10f : ./mnt -n 136 -a...

GLIBC locale - bug mount

GLIBC locale - bug mount / mount exploit for glibc locale bug tested on redhat 6.2 and slackware 7.0 and debian 2.2 Debian 2.2 mount-2.10f : ./mnt -n 136 -a 0x080589a0 -i 192 Redhat 6.2 mount-2.10f : ./mnt -n 114 -a 0x080565dc -i 112 compiled on rh 6.2 mount-2.10m: ./mnt -n 114 -a 0x08059218 -i 1...

GLIBC locale - bug mount

/ mount exploit for glibc locale bug tested on redhat 6.2 and slackware 7.0 and debian 2.2 Debian 2.2 mount-2.10f : ./mnt -n 136 -a 0x080589a0 -i 192 Redhat 6.2 mount-2.10f : ./mnt -n 114 -a 0x080565dc -i 112 compiled on rh 6.2 mount-2.10m: ./mnt -n 114 -a 0x08059218 -i 112 "objdump /bin/mount |...

GLIBC (via /bin/su) Local Root Exploit

Exploit for linux platform in category local exploits ====================================== GLIBC via /bin/su Local Root Exploit ====================================== / Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of...

GLIBC - '/bin/su' Local Privilege Escalation

/ Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of /bin/su program with the address of the shellcode, so, the program executes it when main returns or exit is called Thanks a lot to rwxrwxrwx for explaining me this technique...

CVE-2000-0824

The unsetenv function in glibc 2.1.1 does not properly unset an environmental variable if the variable is provided twice to a program, which could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables such as LDPRELOAD or...

CVE-2000-0335

The resolver in glibc 2.1.3 uses predictable IDs, which allows a local attacker to spoof DNS query results...

CVE-2000-0335

The CVE-2000-0335 issue affects the resolver in glibc 2.1.3 , which uses predictable IDs. This design allows a local attacker to cause DNS query spoofing by manipulating IDs, undermining DNS query integrity. The vulnerability’s impact is described as the ability to spoof results, with a base CVSS...

CVE-2000-0335: Undefined Security Weakness

The resolver in glibc 2.1.3 uses predictable IDs, which allows a local attacker to spoof DNS query results...

Серьезная уязвимость многих Unix через locale в glibc

Функции работы с locale позволяют пользователям создавать пользовательские отображения строк, при этом не проверяется наличие форматных символов. Функции locale используются многими suid-приложениями. В некоторых случаях проблема становится удаленной из-за некорректной обработки переменных...