123 matches found
OpenBSD 2.x3.x - Local Malformed Binary Execution Denial of Service
OpenBSD 2.x3.x - Local Malformed Binary Execution Denial of Service // source: https://www.securityfocus.com/bid/8978/info The OpenBSD team has fixed a vulnerability in the OpenBSD kernel when handling certain executables. It appears that the problem lies in the lack of specific sanity checks on...
OpenBSD 3.3 - 'Semget()' Integer Overflow (2)
// source: https://www.securityfocus.com/bid/8464/info A vulnerability has been discovered in the OpenBSD semget system call. The problem occurs due to insufficient sanity checks before allocating memory using the user-supplied nsems value as an argument. As a result, an attacker may be capable o...
OpenBSD 3.3 - 'Semget()' Integer Overflow (1)
// source: https://www.securityfocus.com/bid/8464/info A vulnerability has been discovered in the OpenBSD semget system call. The problem occurs due to insufficient sanity checks before allocating memory using the user-supplied nsems value as an argument. As a result, an attacker may be capable o...
OpenBSD 3.3 - Semget() Integer Overflow (2)
OpenBSD 3.3 - Semget Integer Overflow 2 // source: https://www.securityfocus.com/bid/8464/info A vulnerability has been discovered in the OpenBSD semget system call. The problem occurs due to insufficient sanity checks before allocating memory using the user-supplied nsems value as an argument. A...
passlogd sniffer remote buffer overflow root exploit.
Hello. Exploit confirmed possible truth in OpenBSD. But, I did not exploit. Also, did not test in RedHat 8.0. Thank you. -- / Title: Remote Multiple Buffer Overflow vulnerability in passlogd sniffer. + Exploit code: 0x82-Remote.passlogdsniff.xpl.c + Description -- About: passlogd is a purpose-bui...
CVE-2001-1145
fts routines in FreeBSD 4.3 and earlier, NetBSD before 1.5.2, and OpenBSD 2.9 and earlier can be forced to change chdir into a different directory than intended when the directory above the current directory is moved, which could cause scripts to perform dangerous actions on the wrong directories...
potential buffer overflow in lprm
A bounds check that was added to lprm in 1996 does its checking too late to be effective. Because of the insufficient check, it may be possible for a local user to exploit lprm to gain elevated privileges. It is not know at this time whether or not the bug is actually exploitable. Starting with...
OpenBSD 2.x3.x - CHPass Temporary File Link File Content Revealing
OpenBSD 2.x3.x - CHPass Temporary File Link File Content Revealing source: https://www.securityfocus.com/bid/6748/info It has been reported that a problem with chpass included with OpenBSD may allow local users to gain access to the content of specific files. This vulnerability requires that line...
CVE-2002-2188
OpenBSD before 3.2 allows local users to cause a denial of service kernel crash via a call to getrlimit2 with invalid arguments, possibly due to an integer signedness error...
/usr/libexec/vi.recover script contains vulnerability allowing arbitrary zero-length files to be removed
Overview The /usr/libexec/vi.recover script in OpenBSD has a vulnerability that could allow an attacker to remove arbitrary zero-length files, including device nodes. Description The /usr/libexec/vi.recover script in OpenBSD cleans up vi temp files and informs a user via email if a recovery file...
OpenBSD contains buffer overflow in "select" call
Overview A locally exploitable buffer overflow exists in all versions of OpenBSD. Description The buffer overflow exists in the select2 system call. The overflow occurs if select is supplied with arbitrary negative values. --- Impact Local users can gain system privileges and execute code in the...
CVE-2002-0557
Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes 1 rexec or 2 rsh to run another user's shell, or 3 atrun to change to a different user's directory, possibly due to memory allocation failures or an incorrect call to authapproval...
CVE-2002-0557
Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes 1 rexec or 2 rsh to run another user's shell, or 3 atrun to change to a different user's directory, possibly due to memory allocation failures or an incorrect call to authapproval...
OpenBSD 2.9/3.0 - Default Crontab Root Command Injection
/ source: https://www.securityfocus.com/bid/4495/info OpenBSD ships with a number of cron jobs configured by default. The tasks are for the purpose of summarizing system information. The mail1 utility is used to send the summaries to the root user. This utility supports escaped characters in...
CVE-2001-1559
The uipc system calls uipcsyscalls.c in OpenBSD 2.9 and 3.0 provide user mode return instead of versus rval kernel mode values to the fdrelease function, which allows local users to cause a denial of service and trigger a null dereference...
OpenBSD 2.x/3.0 - User Mode Return Value Denial of Service
// source: https://www.securityfocus.com/bid/3612/info OpenBSD is a freely available implementation of the BSD Operating System. It is based on the NetBSD implementation. Under some conditions, an application launched by a regular user on the system can cause a system crash. When an application o...
OpenBSD local DoS
-----BEGIN PGP SIGNED MESSAGE----- A local denial of service attack against OpenBSD was published today Sunday Dec 02 to the [email protected] mailing list by Marco Peereboom [email protected]. I'm forwarding his message on to the general security community. The effect of the attack is to crash...
CVE-2001-1047
Race condition in OpenBSD VFS allows local users to cause a denial of service kernel panic by 1 creating a pipe in one thread and causing another thread to set one of the file descriptors to NULL via a close, or 2 calling dup2 on a file descriptor in one process, then setting the descriptor to NU...
CVE-2001-0284
Buffer overflow in IPSEC authentication mechanism for OpenBSD 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a malformed Authentication header AH IPv4 option...