Solaris 2.6/2.7 - '/usr/bin/write' Local Overflow

include include / /usr/bin/write overflow proof of conecpt. Tested on Solaris 7 x86 Pablo Sor, Buenos Aires, Argentina. 01/2000 [email protected] usage: write-exp shelloffset retaddroffset default offset should work. / long getesp asm"movl %esp,%eax"; char shell =...

CVE-2000-1031

Technical details of CVE-2000-1031 are not publicly provided in the supplied documents; monitor for updates.

CVE-2000-0996

CVE-2000-0996: A format-string vulnerability in the OpenBSD su utility (and possibly other BSD-based OSes) allows a local attacker to gain root privileges via a malformed shell. The issue is described in the NVD entry with a CVSS v2 base score of 7.2 (HIGH) and LOCAL, LOW–complexity conditions, e...

CVE-2000-1103

rcvtty in BSD 3.0 and 4.0 does not properly drop privileges before executing a script, which allows local attackers to gain privileges by specifying an alternate Trojan horse script on the command line...

CVE-2000-1103

rcvtty in BSD 3.0 and 4.0 does not properly drop privileges before executing a script, which allows local attackers to gain privileges by specifying an alternate Trojan horse script on the command line...

CVE-2000-1103

CVE-2000-1103 affects BSD 3.0/4.0; the rcvtty program does not drop privileges before executing a script, enabling local privilege escalation by supplying an alternate Trojan horse script on the command line. CVSS base score 7.2 (HIGH) from NVD indicates complete impact to confidentiality, integr...

AnalogX Proxy Server Buffer Overflow Vulnerability

From "zer0-logic" [email protected]: Network Security Solutions Inc. Security Advisory Philippine based Security Company Http://www.nssolution.net Http://connect.to/nssi AnalogX Proxy Server DoS/Buffer Overflow Vulnerabilty Author: Abraham Lincoln H. Handle: zer0logic Email :...

CVE-2000-0880

The CVE-2000-0880 entry concerns LPPlus creating the lpdprocess file with world-writable permissions, which allows local users to kill arbitrary processes by specifying a process ID and using the setuid dcclpdshut program to terminate the specified process. Impact is local access and partial inte...

CVE-2000-0318

Atrium Mercur Mail Server 3.2 allows local attackers to read other user's email and create arbitrary files via a dot dot .. attack...

CVE-2000-0468

man in HP-UX 10.20 and 11 allows local attackers to overwrite files via a symlink attack...

CVE-2000-0695

The CVE-2000-0695 entry relates to buffer overflows in the pgxconfig component of the Raptor GFX configuration tool, enabling local users to escalate privileges via crafted command line options. Affected software is the pgxconfig utility within Raptor GFX; the underlying issue is a buffer overflo...

IRIX 6.5.x - usrsbindmplay Local Buffer Overflow

IRIX 6.5.x - usrsbindmplay Local Buffer Overflow / source: https://www.securityfocus.com/bid/1528/info Certain versions of IRIX ship with a version of dmplay which is vulnerable to a buffer overflow attack. The program, dmplay, is used to play movie files under IRIX. The problem at hand is the wa...

Дырки в Secure desktop

Локальные и удаленный возможности для DoS-атаки, включая подмену адреса default gateway...

CVE-2000-0468

man in HP-UX 10.20 and 11 allows local attackers to overwrite files via a symlink attack...

CVE-2000-0224

The CVE-2000-0224 entry refers to ARCserve agent on SCO UnixWare 7.x. The vulnerability is a local privilege escalation via a symlink attack that could allow a local attacker to obtain root privileges. The description clearly states the affected product/component and the root cause (symlink-relat...

CVE-2000-0184

Linux printtool sets the permissions of printer configuration files to be world-readable, which allows local attackers to obtain printer share passwords...

CVE-2000-0155

Windows NT Autorun executes the autorun.inf file on non-removable media, which allows local attackers to specify an alternate program to execute when other users access a drive...

CVE-1999-0480

Midnight Commander 4.x is affected by a local denial of service via a symlink attack. The connected PT-1999-1160 entry confirms the issue in Midnight Commander 4.x and attributes it to a symlink-based condition exploitable by a local attacker to trigger DoS. No remediation or patched versions are...

CVE-2000-0107

Linux apcd program allows local attackers to modify arbitrary files via a symlink attack...

[SECURITY] New version of nvi released

Package: nvi Vulnerability type: local attack Debian-specific: no The version of nvi that was distributed with Debian GNU/Linux 2.1 has an error in the default /etc/init.d/nviboot script: it did not handle filenames with embedded spaces correctly. This made it possible to remove files in the root...