teTeX 1.0.7 - Filters Temporary File Race Condition

/ source: https://www.securityfocus.com/bid/2974/info teTeX is a TeX distribution for UNIX compatible systems. A race condition vulnerability exists in the temporary file handling method used by some teTeX filters. The problem exists because in some cases temporary files are created world-writeab...

teTeX 1.0.7 - Filters Temporary File Race Condition

teTeX 1.0.7 - Filters Temporary File Race Condition / source: https://www.securityfocus.com/bid/2974/info teTeX is a TeX distribution for UNIX compatible systems. A race condition vulnerability exists in the temporary file handling method used by some teTeX filters. The problem exists because in...

Проблема символьных линков в LPRng + TeTeX (symbolic link)

Проблема символьных лдинков дает возможность получить euid/egid lp...

LPRng + tetex tmpfile race - uid lp exploit

If the tetex package and LPRng are installed, there is an exploitable race condition with a tmp file that allows elevation of privs. It's fixed in rawhide, but that doesn't really help people who just use the provided up2date program to keep themselves secure. / Redhat 7.0 LPRng-3.7.4-23 and...

Important: Red Hat Security Advisory: : LPRng fails to drop supplemental group membership

When LPRng drops uid and gid, it fails to drop membership in its supplemental groups. LPRng fails to drop supplemental group membership at init time, though it does properly setuid and setgid. The result is that LPRng, and its children, maintain any supplemental groups that the process starting...

LPRng 3.6.x - Failure To Drop Supplementary Groups

LPRng 3.6.x - Failure To Drop Supplementary Groups / source: https://www.securityfocus.com/bid/2865/info The LPRng software is an enhanced, extended, and portable implementation of the Berkeley LPR print spooler functionality. When the LPRng daemon is initialized, it fails to drop its supplementa...

LPRng 3.6.x - Failure To Drop Supplementary Groups

/ source: https://www.securityfocus.com/bid/2865/info The LPRng software is an enhanced, extended, and portable implementation of the Berkeley LPR print spooler functionality. When the LPRng daemon is initialized, it fails to drop its supplementary groups. As a result, the daemon and any child...

CVE-2000-0917

CVE-2000-0917 describes a format-string vulnerability in LPRng’s use_syslog() in version 3.6.24 (and earlier), enabling remote attackers to execute arbitrary commands. Multiple sources corroborate: Red Hat RHSA-2000-065 notes vulnerability in 3.6.24 and earlier; CERT advisories document the forma...

CVE-2000-0917

Format string vulnerability in usesyslog function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands...

CVE-2000-0917

Format string vulnerability in usesyslog function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands...

CVE-2000-0917: Undefined Security Weakness

Format string vulnerability in usesyslog function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands...

LPRng 3.6.24-1 - Remote Command Execution

LPRng 3.6.24-1 - Remote Command Execution / REMOTE ROOT EXPLOIT for linux x86 - LPRng-3.6.24-1 RedHat 7.0 The RedHat 7.0 replaced the BSD lpr with the LPRng package which is vulnerable to format string attacks because it passes information to the syslog incorrectly. You can get remote root access...

LPRng 3.6.24-1 Remote Root Exploit

Exploit for linux platform in category remote exploits ================================== LPRng 3.6.24-1 Remote Root Exploit ================================== / REMOTE ROOT EXPLOIT for linux x86 - LPRng-3.6.24-1 RedHat 7.0 The RedHat 7.0 replaced the BSD lpr with the LPRng package which is...

LPRng 3.6.24-1 - Remote Command Execution

/ REMOTE ROOT EXPLOIT for linux x86 - LPRng-3.6.24-1 RedHat 7.0 The RedHat 7.0 replaced the BSD lpr with the LPRng package which is vulnerable to format string attacks because it passes information to the syslog incorrectly. You can get remote root access on machines running RedHat 7.0 with lpd...

LPRng (RedHat 7.0) lpd Remote Root Format String Exploit

Exploit for linux platform in category remote exploits ======================================================== LPRng RedHat 7.0 lpd Remote Root Format String Exploit ======================================================== / Copyright c 2000 - Security.is The following material may be freely...

LPRng 3.6.222324 - Remote Command Execution

LPRng 3.6.222324 - Remote Command Execution / LPRng remote root exploit for x86 Linux 9/27/00 - sk8 tested on compiled LPRng 3.6.22/23/24 / include include char sc= "\x29\xdb\x29\xc0\x29\xd2\x31\xc9\xfe\xca\xb0\x46\xcd\x80\x29\xff" "\x47\x47\x47\x43\x43\x43\x31\xc9\x29\xc0\xb0\x3f\xcd\x80\x41\x39...

LPRng 3.6.22/23/24 Remote Root Exploit

Exploit for linux platform in category remote exploits ====================================== LPRng 3.6.22/23/24 Remote Root Exploit ====================================== / LPRng remote root exploit for x86 Linux 9/27/00 - sk8 tested on compiled LPRng 3.6.22/23/24 / include include char sc=...

LPRng (RedHat 7.0) - 'lpd' Format String

/ Copyright c 2000 - Security.is The following material may be freely redistributed, provided that the code or the disclaimer have not been partly removed, altered or modified in any way. The material is the property of security.is. You are allowed to adopt the represented code in your programs,...

LPRng 3.6.22/23/24 - Remote Command Execution

/ LPRng remote root exploit for x86 Linux 9/27/00 - sk8 tested on compiled LPRng 3.6.22/23/24 / include include char sc= "\x29\xdb\x29\xc0\x29\xd2\x31\xc9\xfe\xca\xb0\x46\xcd\x80\x29\xff" "\x47\x47\x47\x43\x43\x43\x31\xc9\x29\xc0\xb0\x3f\xcd\x80\x41\x39"...

LPRng (RedHat 7.0) - lpd Format String

LPRng RedHat 7.0 - lpd Format String / Copyright c 2000 - Security.is The following material may be freely redistributed, provided that the code or the disclaimer have not been partly removed, altered or modified in any way. The material is the property of security.is. You are allowed to adopt th...