CVE-1999-0411

The vulnerability CVE-1999-0411 affects SCO OpenServer Enterprise System v5.0.4p, where startup scripts S84rpcinit, S95nis, S85tcp, and S89nfs are susceptible to a symlink attack that can let a local user gain root access. The root cause is a symlink-attack in the startup scripts, enabling privil...

CVE-1999-0092

Various vulnerabilities in the AIX portmir command allows local users to obtain root access...

Mandrake 6.x / RedHat 6.x / Turbolinux 3.5 b2/4.x/6.0.2 userhelper/PAM - Path (1)

Mandrake 6.0/6.1,RedHat 6.0/6.1,Turbolinux 3.5 b2/4.2/4.4/6.0.2 userhelper/PAM Path Vulnerability 1 source: https://www.securityfocus.com/bid/913/info Because of double path vulnerabilities in the binary userhelper and PAM, it is possible to get root locally on RedHat 6.0 and 6.1 systems. Both...

RH6_rpmmail_exploit.txt

Greetings, A vulnerability exists in the rpmmail package distributed on the Red Hat 6.0 Extra Applications CD. The potential compromise for this bug could be remote or local root or simply remote command execution as "nobody" or similar, depending on your system configuration. By sending a...

SCO_lpr_vuln.txt

Subject: SCO 5.0.5 lpr local root exploit To: [email protected] Greetings, There is a hole in SCO 5.0.5, probably 5.0.x, /usr/bin/lpr. Or more accurately, /usr/lpd/remote/lp, which lpr execs and passes your command line args on to. This means that while /usr/bin/lpr is sgid lp, we'll stil...

Martin Stover Mars NWE 0.99 - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/617/info There are several buffer overflows in the setuid root components of the Mars Netware Emulator package. They allow for a local root compromise through the overflowing of buffers without bounds checking. It is to be assumed that all versions pri...

Martin Stover Mars NWE 0.99 - Local Buffer Overflow

Martin Stover Mars NWE 0.99 - Local Buffer Overflow // source: https://www.securityfocus.com/bid/617/info There are several buffer overflows in the setuid root components of the Mars Netware Emulator package. They allow for a local root compromise through the overflowing of buffers without bounds...

pam_unix_passwd.so.txt

Date: Wed, 23 Dec 1998 13:12:45 +0100 From: Michal Zalewski Reply-To: Bugtraq List To: [email protected] Subject: Linux PAM up to 0.64-2 local root compromise As someone said, "Never make any mistaeks." Latest release of Linux Pluggable Authentication Modules pam-0.64-2, as well as previous...

aix-infod.txt

RSI.0011.11-12-98.AIX.INFOD |:::. |::::: |::::. |::::: |::::: |::::. .. :: .. .. :: .. .. .. :: |:::: |:::: |:::: :::::: |::::: |:::: |: |: :: |: |: |:: |: |: :: |: :: |::::: |: |::::: |::::: |::::: Repent Security Incorporated, RSI http://www.repsec.com RSI ALERT ADVISORY --- CREDIT...

S.u.S.E Linux 5.2 - gnuplot Local Overflow Local Privilege Escalation

S.u.S.E Linux 5.2 - gnuplot Local Overflow Local Privilege Escalation / source: https://www.securityfocus.com/bid/319/info Linux gnuplot 3.5 is shipped with S.u.S.E. Linux 5.2 and installed suid root by default. There is a buffer overflow vulnerability present in gnuplot which allows for users to...

RedHat Linux 5.05.15.2 Slackware Linux 3.5 - klogd Local Buffer Overflow (2)

RedHat Linux 5.05.15.2 Slackware Linux 3.5 - klogd Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/398/info It is possible to cause a denial of service remote and local through generating old, obscure kernel messages not terminated with \n in klogd. The problem exists because...

RedHat Linux 5.0/5.1/5.2 / Slackware Linux 3.5 - 'klogd' Local Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/398/info It is possible to cause a denial of service remote and local through generating old, obscure kernel messages not terminated with \n in klogd. The problem exists because of a buffer overflow in the klogd handling of kernel messages. It is...

RedHat Linux 5.0/5.1/5.2 / Slackware Linux 3.5 - 'klogd' Local Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/398/info It is possible to cause a denial of service remote and local through generating old, obscure kernel messages not terminated with \n in klogd. The problem exists because of a buffer overflow in the klogd handling of kernel messages. It is...

RedHat Linux 5.05.15.2 Slackware Linux 3.5 - klogd Local Buffer Overflow (1)

RedHat Linux 5.05.15.2 Slackware Linux 3.5 - klogd Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/398/info It is possible to cause a denial of service remote and local through generating old, obscure kernel messages not terminated with \n in klogd. The problem exists because...

Solaris 2.5.1 - kcms Local Buffer Overflow (1)

Solaris 2.5.1 - kcms Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/452/info There is an unchecked sprintf call in the versions of /usr/openwin/bin/kcmsconfigure shipped with solaris 2.5, 2.5.1 and 2.6. Unfortunately, kcmsconfigure is installed setuid root, making it possibl...

Solaris 2.5.1 - kcms Local Buffer Overflow (2)

Solaris 2.5.1 - kcms Local Buffer Overflow 2 / source: https://www.securityfocus.com/bid/452/info There is an unchecked sprintf call in the versions of /usr/openwin/bin/kcmsconfigure shipped with solaris 2.5, 2.5.1 and 2.6. Unfortunately, kcmsconfigure is installed setuid root, making it possible...

CVE-1999-0139

Buffer overflow in Solaris x86 mkcookie allows local users to obtain root access...

Solaris 2.5.1 - License Manager

Solaris 2.5.1 - License Manager source: https://www.securityfocus.com/bid/461/info The Solaris License Manager that ships with versions 2.5.1 and 2.6 is vulnerable to multiple symlink attacks. License Manager creates lockfiles owned by root and set mode 666 which it writes to regularily. It follo...

Linux libc 5.3.125.4 (RedHat Linux 4.0) - vsyslog() Local Buffer Overflow

Linux libc 5.3.125.4 RedHat Linux 4.0 - vsyslog Local Buffer Overflow // source: https://www.securityfocus.com/bid/475/info A buffer overflow is present in linux libc 5.4.32 and below that allows a user to obtain local root access under some conditions. The overflow is in the function vsyslog and...

Xt Library Local Root Command Execution Exploit

Exploit for linux platform in category local exploits =============================================== Xt Library Local Root Command Execution Exploit =============================================== include include include define DEFAULTOFFSET 0 define BUFFERSIZE 1491 long getespvoid asm"movl...