Oracle Automated Service Manager 1.3 - Installation Privilege Escalation

Oracle Automated Service Manager 1.3 local root during install Larry W. Cashdollar 1/29/2013 @larry0 SUNWsasm-1.3.1-20110815093723 https://updates.oracle.com/Orion/Services/download?type=readme&aru=15864534 From the README: "Oracle Automated Service Manager 1.3.1 Oracle Automated Service Manager ...

Oracle Automated Service Manager 1.3 Local Root

Oracle Automated Service Manager 1.3 local root during install Larry W. Cashdollar 1/29/2013 @larry0 SUNWsasm-1.3.1-20110815093723 https://updates.oracle.com/Orion/Services/download?type=readme&aru=15864534 From the README: "Oracle Automated Service Manager 1.3.1 Oracle Automated Service Manager ...

Allied Telesis AT-MCF2000M 3.0.2 Local Root

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2013-01-02 Allied Telesis AT-MCF2000M 3.0.2 Gaining Root Shell Access Device: "The AT-MCF2000M is the management module for the...

Local root exploit for Centrify Deployment Manager < v2.1.0.283 local root

/Local root exploit for Centrify Deployment Manager v2.1.0.283 local root, Centrify released a fix very quickly - nice vendor response. http://vapid.dhs.org/exploits/centrifylocalr00t.c CVE-2012-6348 12/17/2012 http://vapid.dhs.org/advisories/centrifydeploymentmanagerinsecuretmp2.html Greetings...

Centrify Deployment Manager 2.1.0.283 Local Root

/Local root exploit for Centrify Deployment Manager v2.1.0.283 local root, Centrify released a fix very quickly - nice vendor response. CVE-2012-6348 12/17/2012 http://vapid.dhs.org/advisories/centrifydeploymentmanagerinsecuretmp2.html Greetings vladz, Thanks for the inotify & syscall technique...

Centrify Deployment Manager v2.1.0.283 local root

Centrify Deployment Manager v2.1.0.283 local root 12/7/2012 Taking a little longer look at the software, I managed to win a race condition and get root with files in /tmp. Here is my analysis: root@h0g:/tmp ls -l /etc/shadow -r-------- 1 root shadow 1010 Dec 7 21:42 /etc/shadow root@h0g:/tmp...

Centrify Deployment Manager 2.1.0.283 - Local Privilege Escalation

Centrify Deployment Manager 2.1.0.283 - Local Privilege Escalation Centrify Deployment Manager v2.1.0.283 local root 12/7/2012 Taking a little longer look at the software, I managed to win a race condition and get root with files in /tmp. Here is my analysis: root@h0g:/tmp ls -l /etc/shadow...

Centrify Deployment Manager 2.1.0.283 Local Root Vulnerability

Centrify Deployment Manager version 2.1.0.283 suffers from a race condition in /tmp that allows for local root privilege escalation. Centrify Deployment Manager v2.1.0.283 local root 12/7/2012 Taking a little longer look at the software, I managed to win a race condition and get root with files i...

Centrify Deployment Manager 2.1.0.283 Local Root

Centrify Deployment Manager v2.1.0.283 local root 12/7/2012 Taking a little longer look at the software, I managed to win a race condition and get root with files in /tmp. Here is my analysis: root@h0g:/tmp ls -l /etc/shadow -r-------- 1 root shadow 1010 Dec 7 21:42 /etc/shadow root@h0g:/tmp...

soapbox Local Root / Privilege Escalation Vulnerability

----------------------------------- soapbox 0.3.1 = Local Root Exploit ----------------------------------- Vendor URI: http://dag.wieers.com/home-made/soapbox/ Credit: Jean Pascal Pereira [email protected] Description: "Soapbox allows to restrict processes to write only to those places you want...

Soapbox 0.3.1 Local Root

----------------------------------- soapbox 0.3.1 Description: "Soapbox allows to restrict processes to write only to those places you want. Read-access however is still based on file-permissions. By preloading the Soapbox library, you can run programs as root and monitor which writes/changes are...

soapbox 0.3.1 <= Local Root Exploit

Exploit for linux platform in category local exploits ----------------------------------- soapbox 0.3.1 Description: "Soapbox allows to restrict processes to write only to those places you want. Read-access however is still based on file-permissions. By preloading the Soapbox library, you can run...

bsd/x86 Ver. 8.x - Local Root Exploit

/ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 x Official Website: http://www.1337day.com 0 1 x...

Slackware Advisory SSA:2009-111-01 udev

The remote host is missing an update as announced via advisory SSA:2009-111-01. OpenVAS Vulnerability Test $Id: esoftslkssa200911101.nasl 6598 2017-07-07 09:36:44Z cfischer $ Description: Auto-generated from the corresponding slackware advisory Authors: Thomas Reinke Copyright: Copyright c 2012...

Slackware Advisory SSA:2008-042-01 kernel exploit fix

The remote host is missing an update as announced via advisory SSA:2008-042-01. OpenVAS Vulnerability Test $Id: esoftslkssa200804201.nasl 6598 2017-07-07 09:36:44Z cfischer $ Description: Auto-generated from the corresponding slackware advisory Authors: Thomas Reinke Copyright: Copyright c 2012...

Slackware: Security Advisory (SSA:2008-042-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mandrake Linux Security Advisory : lpr (MDKSA-2000:054)

There is a format string bug in lpr with its calls to the syslog facility. There are no known exploits at ths time, but it may be possible for a user to gain local root access. This new lpr fixes this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : sysklogd (MDKSA-2000:050-1)

A problem exists with the kernel logging daemon klogd in the sysklogd package. A 'format bug' makes klogd vulnerable to local root compromise, as well as the possibility for remote vulnerabilities under certain circumstances, which are unprobable. There is also a more probable semi-remote exploit...

Viscosity OpenVPN OS X Local Root

!/bin/sh Viscatory zx2c4 After the hullabaloo from the Tunnelblick local root, savy Mac users began defending Viscosity, another OS X VPN client. They figured, since they spent money on Viscosity, surely it would be better designed than the free open-source alternative. Unfortunately, this exploi...

file clobbering vulnerability in Solaris update manager &amp; local root with SUNWbindr install.

Hi list, Two small problems I noticed with Oracle Solaris Update Manager and the latest patch cluster on Solaris 10 x86. += Local Root If the system administrator is updating the system using update manager or smpatch multi user mode a race condition exists with the postinstall script for SUNWbin...