Code injection

CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program...

CVE-2015-8212

CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program...

CVE-2015-8212

CVE-2015-8212 affects bozohttpd (NetBSD: 6.0.x up to 6.0.6, 6.1.x up to 6.1.5, 7.0). The flaw is in the CGI suffix handler when the -C option is used, allowing crafted arguments to be processed by a non-CGI aware program and enabling remote code execution. Severity/impact cited across sources ali...

BSD libc contains a buffer overflow vulnerability in link_ntoa()

Overview The BSD libc library's linkntoa function may be vulnerable to a classic buffer overflow. It is currently unclear if this issue is exploitable. Description CWE-120: Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' - CVE-2016-6559Improper bounds checking of the obuf...

tnftp: Arbitrary code execution

Background tnftp is a NetBSD FTP client with several advanced features. Description The fetchurl function in usr.bin/ftp/fetch.c allows remote attackers to execute arbitrary commands via a Impact A remote attacker could possibly execute arbitrary code with the privileges of the process. Workaroun...

NetBSD mail.local - Privilege Escalation (Metasploit)

Exploit for bsd platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "msf/core" class MetasploitModule 'NetBSD mail.local Privilege Escalation', 'Description' = %q This module...

NetBSD - 'mail.local(8)' Local Privilege Escalation (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "msf/core" class MetasploitModule 'NetBSD mail.local Privilege Escalation', 'Description' = %q This module attempts to exploit a race condition in mail.local with...

NetBSD mail.local Privilege Escalation

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "msf/core" class MetasploitModule 'NetBSD mail.local Privilege Escalation', 'Description' = %q This module attempts to exploit a race condition in mail.local with...

NetBSD Local Privilege Vulnerability

NetBSD is a free and open source Unix-like operating system. NetBSD suffers from a local elevation of privilege vulnerability, which allows a local attacker to exploit the vulnerability to elevate privileges and gain root privileges...

NetBSD mail.local(8) Local Root

// Source: http://akat1.pl/?id=2 include include include include include include include include define ATRUNPATH "/usr/libexec/atrun" define MAILDIR "/var/mail" static int overwriteatrunvoid char script = "! /bin/sh\n" "cp /bin/ksh /tmp/ksh\n" "chmod +s /tmp/ksh\n"; sizet size; FILE fh; int rv =...

NetBSD - 'mail.local(8)' Local Privilege Escalation

// Source: http://akat1.pl/?id=2 include include include include include include include include define ATRUNPATH "/usr/libexec/atrun" define MAILDIR "/var/mail" static int overwriteatrunvoid char script = "! /bin/sh\n" "cp /bin/ksh /tmp/ksh\n" "chmod +s /tmp/ksh\n"; sizet size; FILE fh; int rv =...

NetBSD - mail.local(8) Local Privilege Escalation

NetBSD - mail.local8 Local Privilege Escalation // Source: http://akat1.pl/?id=2 include include include include include include include include define ATRUNPATH "/usr/libexec/atrun" define MAILDIR "/var/mail" static int overwriteatrunvoid char script = "! /bin/sh\n" "cp /bin/ksh /tmp/ksh\n" "chm...

NetBSD mail.local(8) - Privilege Escalation (NetBSD-SA2016-006)

Exploit for bsd platform in category local exploits // Source: http://akat1.pl/?id=2 include include include include include include include include define ATRUNPATH "/usr/libexec/atrun" define MAILDIR "/var/mail" static int overwriteatrunvoid char script = "! /bin/sh\n" "cp /bin/ksh /tmp/ksh\n"...

NetBSD mail.local Privilege Escalation

This module attempts to exploit a race condition in mail.local with SUID bit set on: NetBSD 7.0 - 7.0.1 verified on 7.0.1 NetBSD 6.1 - 6.1.5 NetBSD 6.0 - 6.0.6 Successful exploitation relies on a crontab job with root privilege, which may take up to 10min to execute. Module Options msf use...

NetBSD bozohttpd CGI Processor Arbitrary Code Execution Vulnerability

NetBSD is a free and open source Unix-like operating system. A security vulnerability in NetBSD's bozohttpd CGI processor allows remote attackers to submit special requests to execute arbitrary code...

Lynis 2.2.0 - Security Auditing Tool for Unix/Linux Systems

Lynis is an open source security auditing tool. Commonly used by system administrators, security professionals and auditors, to evaluate the security defenses of their Linux/Unix based systems. It runs on the host itself, so it can perform very extensive security scans. Supported operating system...

paravirtualized drivers incautious about shared memory contents

ISSUE DESCRIPTION The compiler can emit optimizations in the PV backend drivers which can lead to double fetch vulnerabilities. Specifically the shared memory between the frontend and backend can be fetched twice during which time the frontend can alter the contents possibly leading to arbitrary...

Operating System (OS) Detection (Telnet)

Telnet banner based Operating System OS detection. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH SPDX-FileCopyrightText: Reworked, improved and extended detection code and pattern since 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by th...

CVE-2008-2476

The IPv6 Neighbor Discovery Protocol NDP implementation in 1 FreeBSD 6.3 through 7.1, 2 OpenBSD 4.2 and 4.3, 3 NetBSD, 4 Force10 FTOS before E7.7.1.1, 5 Juniper JUNOS, and 6 Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attacke...

[CVE-2015-4624] Predictable CSRF tokens in WiFi Pineapple firmware <= 2.3.0

Overview =============== WiFi Pineapples are a penetration testing tool used in offensive wireless activities. These devices run on a modified OpenWRT based on netBSD operating system. They include a web-based management interface. It has been discovered they have predictable anti-CSRF tokens bas...