[SECURITY] [DSA 119-1] ssh channel bug

Package: openssh Vulnerability: local root exploit, remote client exploit Debian-specific: no Joost Pol [email protected] reports that OpenSSH versions 2.0 through 3.0.2 have an off-by-one bug in the channel allocation code. This vulnerability can be exploited by authenticated users to gain root...

Tarantella Enterprise 3 - Symbolic Link

source: https://www.securityfocus.com/bid/4115/info Tarantella Enterprise 3 contains a locally exploitable symbolic link vulnerability during it's installation procedure. This vulnerability can be exploited to elevate privileges. An attacker anticipating the install of Tarantella could create a...

Ximian Mozilla: The 2618 Bug

NOTE TO THE MODERATOR: This was sent yesterday but i guess didn't make it since this doesn't seem to affect a redhat itself, it affects the mozilla packages distrbuted by Ximian: The test system look like: bash rpm -qa | grep mozilla mozilla-0.9.8-1.ximian.2 mozilla-mail-0.9.8-1.ximian.2...

[SECURITY] [DSA 112-1] New hanterm packages fix buffer overflow

-------------------------------------------------------------------------- Debian Security Advisory DSA 112-1 [email protected] http://www.debian.org/security/ Martin Schulze February 16th, 2002 - -------------------------------------------------------------------------- Package : hanterm...

Hanterm 3.3 - Local Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/4050/info Hanterm is a replacement for xterm which includes Hangul support, used for Korean language systems. A buffer overflow error exists in hanterm. If it is called locally with a maliciously constructed parameter, it is possible to overflow a...

Hanterm 3.3 - Local Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/4050/info Hanterm is a replacement for xterm which includes Hangul support, used for Korean language systems. A buffer overflow error exists in hanterm. If it is called locally with a maliciously constructed parameter, it is possible to overflow a...

CVE-2001-1034

Format string vulnerability in Hylafax on FreeBSD allows local users to execute arbitrary code via format specifiers in the -h hostname argument for 1 faxrm or 2 faxalter...

Unixware 7.1.1 scoadminreg.cgi local exploit

unixware: uname -a UnixWare unixware 5 7.1.1 i386 x86at SCO UNIXSVR5 unixware: id uid=101mearee gid=1other unixware: ./scoadminreg.sh jGgM root exploit http://www.netemperor.com/ Mail: [email protected] Manager: -c /tmp/jggm;/tmp/jggm; ERROR: Cannot find a Webtop object associated with -c /tmp/jggm...

Xitami Webserver stores admin password in clear text.

I am releasing this a bit early as the vendor has been aware of this issue for a while now. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vapid Labs Larry W. Cashdollar Xitami Webserver clear text password storage vulnerability. Date Published: 11/23/2001 Advisory ID: 11232001-02 Title: Xitami...

OSX remote root

I have seen mention of nidump being used local to an OSX box to take root... I have found that with the use of "tags" it is also a remote root. I have not notified apple due to the fact that they did nothing about the original local exploit. Any machine with a "network" nidomain is vulnerable. It...

CVE-2001-0759

A concise summary of CVE-2001-0759: A buffer overflow in bctool of Jetico BestCrypt versions up to 0.8.1 allows local users to execute arbitrary code via a file or directory with an excessively long pathname processed during an unmount. Affected software: Jetico BestCrypt (bctool)

FreeBSD-SA-01:62.uucp

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:62 Security Advisory FreeBSD, Inc. Topic: UUCP allows local root exploit Category: core Module: uucp Announced: 2001-10-08 Credits: [email protected] Affects: All release...

Hewlett-Packard HP-UX Software Distributor (SD-UX) contains vulnerability permitting privilege escalation

Overview HP9000 Series 700/800 running HP-UX releases 10.01, 10.10, 10.20 and 11.00 are affected by a buffer overflow in Hewlett-Packard's HP-UX Software Distributor SD-UX. A local user can exploit this vulnerability to gain elevated privileges. Description Several applications in SD-UX contain...

[SECURITY] [DSA 079-1] New UUCP packages fix local exploit

---------------------------------------------------------------------------- Debian Security Advisory DSA 079-1 [email protected] http://www.debian.org/security/ Martin Schulze September 24, 2001 - ---------------------------------------------------------------------------- Package : uucp...

CVE-1999-1408

CVE-1999-1408 affects AIX 4.1.4 and HP-UX 10.01 and 9.05. The vulnerability arises when a local user opens a socket to a localhost port, calls shutdown to clear the socket, and then reuses the same socket to connect to a different localhost port, which can trigger a denial of service (crash). The...

CVE-1999-1272

CVE-1999-1272 concerns buffer overflows in the CDROM Confidence Test program (cdrom), enabling local users to gain root privileges. The provided sources describe the vulnerability as local, with root-level impact, but no remediation or patch details are included in the documents. Potential exploi...

BSDI 3.0/3.1 - Local Kernel Denial of Service

/ source: https://www.securityfocus.com/bid/3220/info It has been reported that there is a locally exploitable vulnerability in BSDI. It is allegedly possible for a userland process to cause the kernel to halt. This may be due to a bad system call. / / BSDiv3.0/3.1 system failure, by...

Local exploit for TrollFTPD-1.26

Affects: TrollFTPD 1.26 probably earlier Severity: local users can gain root access. Fix: upgrade to TrollFTPD-1.27 Fix URL: ftp://ftp.trolltech.com/freebies/ftpd/troll-ftpd-1.27.tar.gz Description: An error in the handling of recursive directory listings can result in an exploitable buffer...

nerf.iis.dos.txt

--== NERF gr0up security advisory 4 ==-- MS IIS local and remote DoS 1. Vulnerable soft: IIS 4,5 2. Description: Openning and reading of device files com1, com2, etc. using Scripting.FileSystemObject will crash ASP-processor asp.dll. 3. Local exploit: If you have permission on creating .asp-file,...

Solaris whodo Vulnerability

Vulnerability in Solaris whodo Date Published: July 5, 2001 Advisory ID: N/A Bugtraq ID: 2935 CVE CAN: Non currently assigned. Title: Solaris whodo Buffer Overflow Vulnerability Class: Boundary Error Condition Remotely Exploitable: No Locally Exploitable: Yes Vulnerability Description: The whodo...