CVE-2005-4782

NetBSD 2.0 before 2.0.4, 2.1 before 2.1.1, and 3, when the kernel is compiled with "options DIAGNOSTIC," allows local users to cause a denial of service kernel assertion panic via a negative linger time in the SOLINGER socket option...

CVE-2005-4779

verifiedexecioctl in verifiedexec.c in NetBSD 2.0.2 calls NDINIT with UIOUSERSPACE rather than UIDSYSSPACE, which removes the functionality of the verified exec kernel subsystem and might allow local users to execute Trojan horse programs...

CVE-2005-4352

The securelevels implementation in NetBSD 2.1 and earlier, and Linux 2.6.15 and earlier, allows local users to bypass time setting restrictions and set the clock backwards by setting the clock ahead to the maximum unixtime value 19 Jan 2038, which then wraps around to the minimum value 13 Dec 190...

CVE-2005-4733

NetBSD 2.0 before 20050316 and NetBSD-current before 20050112 allow local users to cause a denial of service infinite loop and system hang by calling the FCLOSEM fcntl with a parameter value of 0...

CVE-2005-4691

imake in NetBSD before 2.0.3, NetBSD-current before 12 September 2005, certain versions of X.Org, and certain versions of XFree86 allows local users to overwrite arbitrary files via a symlink attack on the temporary file for the file.0 target, which is used for a pre-formatted manual page...

CVE-2005-4741

NetBSD 1.6, NetBSD 2.0 through 2.1, and NetBSD-current before 20051031 allows local users to gain privileges by attaching a debugger to a setuid/setgid PSUGID process that performs an exec without a reset of real credentials...

CVE-2005-4783

kernfsxread in kernfsvnops.c in NetBSD before 20050831 does not check for a negative offset when reading the message buffer, which allows local users to read arbitrary kernel memory...

CVE-2003-1289

The iBCS2 system call translator for statfs in NetBSD 1.5 through 1.5.3 and FreeBSD 4 up to 4.8-RELEASE-p2 and 5 up to 5.1-RELEASE-p1 allows local users to read portions of kernel memory memory disclosure via a large length parameter, which copies additional kernel memory into userland memory...

CVE-2003-1289

The CVE-2003-1289 issue affects the iBCS2 system call translator for statfs in NetBSD 1.5–1.5.3 and FreeBSD 4 (up to 4.8-RELEASE-p2) and 5 (up to 5.1-RELEASE-p1). The underlying flaw allows local users to read portions of kernel memory (memory disclosure) via a large length parameter that copies ...

netbsd/x86 setreuid0, 0; execve"/bin//sh", ..., NULL; 30 bytes

netbsd/x86 setreuid0, 0; execve"/bin//sh", ..., NULL; 30 bytes. Shellcode exploit for netbsdx86 platform / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, setreuid0, 0; execve"/bin//sh", ..., NULL; / include include include char scode = "\x31\xc0" // xor %eax,%eax "\x50" // push %eax...

netbsd/x86 setreuid(0, 0); execve("/bin//sh", ..., NULL); 30 bytes

Exploit for netbsd/x86 platform in category shellcode ================================================================== netbsd/x86 setreuid0, 0; execve"/bin//sh", ..., NULL; 30 bytes ================================================================== / minervini at neuralnoise dot com c 2005...

netbsd/x86 callback shellcode (port 6666) 83 bytes

Exploit for netbsd/x86 platform in category shellcode ================================================== netbsd/x86 callback shellcode port 6666 83 bytes ================================================== / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, callback shellcode port 6666; /...

netbsd/x86 setreuid(0, 0); execve("/bin//sh", ..., NULL); 29 bytes

Exploit for netbsd/x86 platform in category shellcode ================================================================== netbsd/x86 setreuid0, 0; execve"/bin//sh", ..., NULL; 29 bytes ================================================================== / minervini at neuralnoise dot com c 2005...

netbsd/x86 callback shellcode (port 6666) 83 bytes

No description provided by source. / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, callback shellcode port 6666; / include sys/types.h include stdio.h include string.h char scode = "\x31\xc0" // xor %eax,%eax "\x31\xc9" // xor %ecx,%ecx "\x50" // push %eax "\x40" // inc %eax "\x50" //...

netbsd/x86 setreuid0, 0; execve"/bin//sh", ..., NULL; 29 bytes

netbsd/x86 setreuid0, 0; execve"/bin//sh", ..., NULL; 29 bytes. Shellcode exploit for netbsdx86 platform / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, setreuid0, 0; execve"/bin//sh", ..., NULL; note: unsafe shellcode, but 29 bytes long; doesn't work if eax & 0x40000000 != 0; / includ...

netbsd/x86 callback shellcode port 6666 83 bytes

netbsd/x86 callback shellcode port 6666 83 bytes. Shellcode exploit for netbsdx86 platform / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, callback shellcode port 6666; / include include include char scode = "\x31\xc0" // xor %eax,%eax "\x31\xc9" // xor %ecx,%ecx "\x50" // push %eax...

Multiple NetBSD vulnerabilities

Integer overflow in FreeBSD compatibility subsystem, imake symbolic links problem, ptrace privilege escalation. Known vulnerabilities in CVS, telnet, OpenSSL, ntpd are patched...

[SA17389] NetBSD Update Fixes Multiple Vulnerabilities

TITLE: NetBSD Update Fixes Multiple Vulnerabilities SECUNIA ADVISORY ID: SA17389 VERIFY ADVISORY: http://secunia.com/advisories/17389/ CRITICAL: Highly critical IMPACT: Security Bypass, Privilege escalation, DoS, System access WHERE: From remote OPERATING SYSTEM: NetBSD 1.x...

CVE-2002-2092

CVE-2002-2092 describes a race condition in exec on OpenBSD ≤4.0, NetBSD ≤1.5.2, and FreeBSD ≤4.4 that lets local users gain privileges by attaching a debugger to a process before the kernel has confirmed setuid/setgid. The core issue is a window where privilege elevation can occur prior to prope...

Ettercap contains a format string error in the "curses_msg()" function

Overview Ettercap has a format string vulnerability in the ncurses user interface. Description Ettercap is open-source software designed for man-in-the-middle attacks on LANs. Ettercap contains multiple user interfaces, including one written using ncurses, a library for manipulating text screens...