IBM AIX utilities multiple security vulnerabilities

Multiple suid root ftp client buffer overflow, dynamic library loading via -R command line argument in pioout, buffer overflow with terminal control sequences in capture...

iDefense Security Advisory 07.26.07: IBM AIX pioout Arbitrary Library Loading Vulnerability

IBM AIX pioout Arbitrary Library Loading Vulnerability iDefense Security Advisory 07.26.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 26, 2007 I. BACKGROUND The pioout program is a setuid root application, installed by default under multiple versions of IBM AIX, that is used to...

IBM AIX 5.3 SP6 - 'pioout' Arbitrary Library Loading Privilege Escalation

!/bin/sh 07/2007: public release IBM AIX piolib.c include void init attribute constructor; void init seteuid0; setuid0; putenv"HISTFILE=/dev/null"; execl"/bin/bash", "bash", "-i", void 0; execl"/bin/sh", "sh", "-i", void 0; perror"execl"; exit1; EOF gcc piolib.c -o piolib -shared -fPIC -r piolib ...

Kerio Webstar privilege escalation

Suid application loads library from current directory...

Arbitrary Library Loading in Informix

NGSSoftware Insight Security Research Advisory Name: Arbitrary Library Loading in Informix Systems Affected: All versions of Informix Severity: High Vendor URL: http://www.ibm.com/ Author: David Litchfield [email protected] Date of Public Advisory: 2nd August 2006 Advisory number:...

[Full-disclosure] iDefense Security Advisory 02.07.06: QNX Neutrino RTOS crttrap Arbitrary Library Loading Vulnerability

QNX Neutrino RTOS crttrap Arbitrary Library Loading Vulnerability iDefense Security Advisory 02.07.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=379 February 7, 2006 I. BACKGROUND QNX Software Systems Ltd.'s Neutrino RTOS QNX is a real-time operating system designed for u...

iDEFENSE Security Advisory 08.29.05: Adobe Version Cue VCNative Arbitrary Library Loading Vulnerability

Adobe Version Cue VCNative Arbitrary Library Loading Vulnerability iDEFENSE Security Advisory 08.29.05 www.idefense.com/application/poi/display?id=296&type=vulnerabilities August 29, 2005 I. BACKGROUND Adobe Version Cue is a software version tracking system for Adobe products distributed with Ado...

Adobe Version Cue 1.0/1.0.1 (-lib) Local Root Exploit (OSX)

Exploit for macOS platform in category local exploits =========================================================== Adobe Version Cue 1.0/1.0.1 -lib Local Root Exploit OSX =========================================================== / Adobe Version Cue VCNativeOSX: local root exploit. dyld by:...

Solaris GSS API privilege escalation

Ralative part is used to load library...

MySQL < 4.0.24 / 4.1.10a Multiple Vulnerabilities

The remote host is running a version of MySQL which older than version 4.0.24 or 4.1.10a. Such versions are potentially affected by multiple issues. - MySQL uses predictable file names when creating temporary tables, which allows local users with 'CREATE TEMPORARY TABLE' privileges to overwrite...

MySQL 4.x - CREATE FUNCTION Arbitrary libc Code Execution

source: https://www.securityfocus.com/bid/12781/info MySQL is reported prone to multiple vulnerabilities that can be exploited by a remote authenticated attacker. The following individual issues are reported: - Insecure temporary file-creation vulnerability. Reports indicate that an attacker with...

[VulnWatch] Mysql CREATE FUNCTION mysql.func table arbitrary library injection

Mysql CREATE FUNCTION mysql.func table arbitrary library injection Author: Stefano Di Paola Vulnerable: Mysql = 4.0.23, 4.1.10 Type of Vulnerability: Local/Remote Privileges Escalation - input validation Tested On : Mandrake 10.1 /Debian Sarge Vendor Status: Notified on March 2005 -- Description...

PostgreSQL Database Server privilege escalation

By using LOAD command it's possible to load dynamic library with server process privileges. Buffer overflow on large cursor's arguments number. Protection bypass on functions execution...

FreeBSD : cyrus-sasl -- dynamic library loading and set-user-ID applications (35)

The following package needs to be updated: cyrus-sasl %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg92268205194711d9bc4a000c41e2cdad.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...

cyrus-sasl -- dynamic library loading and set-user-ID applications

The Cyrus SASL library, libsasl, contains functions which may load dynamic libraries. These libraries may be loaded from the path specified by the environmental variable SASLPATH, which in some situations may be fully controlled by a local attacker. Thus, if a set-user-ID application such as chsh...

Microsoft Windows NT 4.0/2000 - DLL Search Path

source: https://www.securityfocus.com/bid/1699/info When a program executes under Microsoft Windows, it may require additional code stored in DLL library files. These files are dynamically located at run time, and loaded if necessary. A weakness exists in the algorithm used to locate these files...