CVE-2009-0537

CVE-2009-0537 involves an integer overflow in libc’s fts_build() within the fts.c implementation. The root cause is a signed short (fts_level) overflow when traversing very deep directory trees, which can crash an affected program (e.g., du, rm, chmod, chgrp on OpenBSD; SearchIndexer.exe on Windo...

CVE-2009-0537

Integer overflow in the ftsbuild function in fts.c in libc in 1 OpenBSD 4.4 and earlier and 2 Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service application crash via a deep directory tree, related to the ftslevel structure member, as...

CVE-2009-0537

Integer overflow in the ftsbuild function in fts.c in libc in 1 OpenBSD 4.4 and earlier and 2 Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service application crash via a deep directory tree, related to the ftslevel structure member, as...

Libc - libc:fts_*() Local Denial of Service

Libc - libc:fts Local Denial of Service -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 libc:fts:multiple vendors, Denial-of-service Author: Maksymilian Arciemowicz SecurityReason.com Date: - - Dis.: 21.10.2008 - - Pub.: 04.03.2009 CVE: CVE-2009-0537 We are going informing all vendors, about this...

Path traversal

The aspathprepend function in rdeattr.c in bgpd in OpenBSD 4.3 and 4.4 allows remote attackers to cause a denial of service application crash via an Autonomous System AS advertisement containing a long AS path...

CVE-2009-0780

The aspathprepend function in rdeattr.c in bgpd in OpenBSD 4.3 and 4.4 allows remote attackers to cause a denial of service application crash via an Autonomous System AS advertisement containing a long AS path...

CVE-2009-0780

The CVE-2009-0780 entry concerns OpenBSD’s bgpd (versions 4.3 and 4.4). The aspath_prepend function in rde_attr.c is exposed to remote attackers who can trigger a denial of service (application crash) by sending an Autonomous System path that is overly long. The connected sources (NVD entry with ...

CVE-2009-0780

The aspathprepend function in rdeattr.c in bgpd in OpenBSD 4.3 and 4.4 allows remote attackers to cause a denial of service application crash via an Autonomous System AS advertisement containing a long AS path...

BSD/x86 - cat /etc/master.passwd & mail root@localhost - 92 bytes

No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 92 bytes. execve/bin/sh -c "/bin/cat /etc/master.passwd|mail root@localhost"; pueden reemplzar el comando por lo que se les ocurra. / char shellcode= "\xeb\x25" / jmp shellcode+39 / "\x59" / popl...

BSD/x86 - execve(/bin/sh) & setuid(0) - 29 bytes

No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 29 bytes. -setuid0; -execve/bin/sh; / char shellcode= "\x31\xc0" // xor %eax,%eax "\x50" // push %eax "\xb0\x17" // mov $0x17,%al "\x50" // push %eax "\xcd\x80" // int $0x80 "\x50" // push %eax...

BSD/x86 - setuid/execve - 30 bytes

No description provided by source. / $Id: setuid-bsd.c,v 1.6 2004/06/02 12:22:30 raptor Exp $ setuid-bsd.c - setuid/execve shellcode for BSD/x86 Copyright c 2003 Marco Ivaldi [email protected] Short setuid0 and /bin/sh execve shellcode based on esdee's code. Tested on OpenBSD and FreeBSD. / ...

BSD/x86 - setuid/portbind - 94 bytes

No description provided by source. / $Id: portbind-bsd.c,v 1.3 2004/06/02 12:22:30 raptor Exp $ portbind-bsd.c - setuid/portbind shellcode for BSD/x86 Copyright c 2003 Marco Ivaldi [email protected] Simple portbind shellcode that bind's a setuid0 shell on port 31337/tcp based on bighawk's...

OpenBSD bgpd守护程序远程拒绝服务漏洞

BUGTRAQ ID: 33828 OpenBSD是一款开放源代码Unix类操作系统。 OpenBSD的usr.sbin/bgpd/rdeattr.c文件中的aspathprepend函数在将其自己的AS附加到超长AS路径时存在错误，如果远程攻击者广播了超长的AS路径就会导致bgpd进程崩溃。 OpenBSD OpenBSD 4.4 OpenBSD OpenBSD 4.3 厂商补丁： OpenBSD ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

OpenBSD BGP UPDATE消息远程拒绝服务漏洞

BUGTRAQ ID: 33553 OpenBSD是一款开放源代码Unix类操作系统。 OpenBSD系统的BGP协议在处理畸形结构的UPDATE消息时存在漏洞，远程攻击者可能利用此漏洞导致BGP服务不可用。 当BGP UPDATE消息中包含一个无效的AS4PATH时，会导致OpenBSD处理出错导致会话中止，远程攻击者可以通过构造恶意的请求导致BGP服务不可用。 OpenBSD 4.4 OpenBSD 4.3 厂商补丁： OpenBSD ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： OpenBSD 4.3:...

OpenSSL 'EVP_VerifyFinal'函数签名验证漏洞

BUGTRAQ ID: 33150 CVE ID：CVE-2008-5077 CNCVE ID：CNCVE-20085077 OpenSSL是一款开放源码的SSL实现，用来实现网络通信的高强度加密。 部分OpenSSL函数验证DSA和ECDSA密钥时不正确验证"EVPVerifyFinal"函数返回值，发送特殊构建的签名证书链给客户端，可绕过签名检查。 通过恶意服务器或中间人攻击，可使证书链中的畸形SSL/TLS签名绕过客户端软件检查，导致盲目信任并泄漏敏感信息。 成功利用此漏洞需要服务器使用包含DSA或者ECDSA密钥的证书。 Ubuntu Ubuntu Linux 8.10 spar...

screen_4_0_3_password_bypass_openbsd.txt

/ / / / / / / / / / / / / // / / / / / / / / / // / / / // // / / / / / // ///// // // // Helith - 0815 -------------------------------------------------------------------------------- Author : Rembrandt Date : 2007-06-03 Affected Software: screen . Password: type ctrl-c $ screen -r Regained acce...

OpenBSD/x86 - Load Kernel Module (/tmp/o.o) Shellcode (66 bytes)

OpenBSD/x86 - Load Kernel Module /tmp/o.o Shellcode 66 bytes. Shellcode exploit for OpenBSDx86 platform / The modload shellcode loads /tmp/o.o module very usefull if you have rootkit as kernel module in the /tmp dir and you can easily change the path directly in the code Size 66 bytes OS OpenBSD...

OpenBSD/x86 - setuid(0) + Load Kernel Module (/tmp/o.o) Shellcode (74 bytes)

OpenBSD/x86 - setuid0 + Load Kernel Module /tmp/o.o Shellcode 74 bytes. Shellcode exploit for OpenBSDx86 platform / The modload shellcode setuid0 loads /tmp/o.o module very usefull if you have rootkit as kernel module in the /tmp dir Size 74 bytes OS OpenBSD /rootteam/dev0id rootteam.void.ru...

OpenBSD/x86 - reboot() Shellcode (15 bytes)

OpenBSD/x86 - reboot Shellcode 15 bytes. Shellcode exploit for OpenBSDx86 platform // ----------bsd/x86 reboot shellcode----------------- // AUTHOR : beosroot // INFO : OpenBSD x86 reboot shellcode // EMAIL : [email protected] // [email protected] char shellcode =...

kernel: i915 kernel drm driver arbitrary ioremap

The i915 driver in 1 drivers/char/drm/i915dma.c in the Linux kernel 2.6.24 on Debian GNU/Linux and 2 sys/dev/pci/drm/i915drv.c in OpenBSD does not restrict the DRMI915HWSADDR ioctl to the Direct Rendering Manager DRM master, which allows local users to cause a denial of service memory corruption...