1726 matches found
OpenBSD 3.x - 4.0 vga_ioctl() Local Root Exploit
Exploit for bsd platform in category local exploits ================================================ OpenBSD 3.x - 4.0 vgaioctl Local Root Exploit ================================================ / Critical Security OpenBSD 3.x-4.0 vgaioctl root exploit Bug had been discovered by allmighty Ilja v...
OpenBSD 3.x < 4.0 - 'vga_ioctl()' Local Privilege Escalation
/ Critical Security OpenBSD 3.x-4.0 vgaioctl root exploit Bug had been discovered by allmighty Ilja van Sprundel ilja.netric.org Some code had been stolen from noir's openbsd exploit sources Fix is available: ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/i386/007agp.patch Critical Security...
Null pointer dereference
Unspecified vulnerability in sys/dev/pci/vgapci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agpioctl NULL...
CVE-2007-0085
Unspecified vulnerability in sys/dev/pci/vgapci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agpioctl NULL...
CVE-2007-0085
Unspecified vulnerability in sys/dev/pci/vgapci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agpioctl NULL...
CVE-2007-0085
The CVE-2007-0085 entry concerns the OpenBSD wscons VGA graphics driver (sys/dev/pci/vga_pci.c) on OpenBSD 3.9 and 4.0. When the kernel is built with the PCIAGP option and a non-AGP device is used, a local user may gain privileges. The root cause is described as an UNSPECIFIED vulnerability with ...
[SA23608] OpenBSD "vga" Privilege Escalation Vulnerability
TITLE: OpenBSD "vga" Privilege Escalation Vulnerability SECUNIA ADVISORY ID: SA23608 VERIFY ADVISORY: http://secunia.com/advisories/23608/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system OPERATING SYSTEM: OpenBSD 4.0 http://secunia.com/product/12486/ OpenBSD 3.x...
CVE-2006-6730
OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by replacing the System Management Mode SMM handler via a write to an SMRAM address within /dev/xf86 aka the video card...
CVE-2006-6730
OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by replacing the System Management Mode SMM handler via a write to an SMRAM address within /dev/xf86 aka the video card...
CVE-2006-6730
CVE-2006-6730 affects OpenBSD and NetBSD. The vulnerability allows local users to execute code with root privileges by killing the display server and writing to the X.Org /dev/xf86 device to replace the System Management Mode (SMM) handler via an SMRAM write within /dev/xf86 (the video card RAM r...
CVE-2006-6397
Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal operations. This issue is...
CVE-2006-6397
Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal operations. This issue is...
CVE-2006-6397
The CVE-2006-6397 entry concerns an alleged integer overflow in the banner/banner.c component across FreeBSD, NetBSD, and OpenBSD. The issue is disputed by CVE and others and, because the banner is not setuid, an exploit would not cross privilege boundaries in normal operations; the notes explici...
PT-2006-7008 · Freebsd +2 · Freebsd +2
Name of the Vulnerable Software and Affected Versions: No vulnerable software versions are specified, as the issue is disputed and not considered a vulnerability. Description: The issue in question pertains to an alleged integer overflow in the banner/banner.c file within FreeBSD, NetBSD, and...
CVE-2006-6164
The dlunsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LDPRELOAD to loading processes, which might be leveraged to gain privileges...
CVE-2006-6164
The dlunsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LDPRELOAD to loading processes, which might be leveraged to gain privileges...
CVE-2006-6164
The CVE-2006-6164 entry concerns OpenBSD 3.9 and 4.0 where the _dl_unsetenv function in loader.c of the ELF ld.so fails to remove duplicate environment variables. This could allow local users to pass dangerous variables (e.g., LD_PRELOAD) to loading processes, potentially enabling privilege escal...
OpenBSD LD.SO本地环境变量清除漏洞
OpenBSD是一款开放源代码的操作系统。 OpenBSD ELF ld.so1不正确过滤环境变量，本地攻击者可以利用漏洞绕过安全设置或可能造成任意指令执行。 目前没有详细漏洞细节提供。 penBSD OpenBSD 4.0 OpenBSD OpenBSD 3.9 补丁下载： OpenBSD OpenBSD 4.0 OpenBSD 005ldso.patch ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/005ldso.patch OpenBSD OpenBSD 3.9 OpenBSD 016ldso.patch...
OpenBSD ld.so本地环境变量继承漏洞
OpenBSD是一款开放源代码Unix类操作系统。 OpenBSD动态加载器在处理环境变量的继承时存在漏洞，本地攻击者可能利用此漏洞提升自己的权限。 OpenBSD动态加载器清除了环境变量，但由于逻辑问题，dlunsetenv可能会被相邻的两项欺骗。 漏洞相关的代码如下： /src/libexec/ld.so/loader.c: -------------- if dlissetugid / Zap paths if sugid... / ... if dlpreload dlpreload = NULL; dlunsetenv"LDPRELOAD", envp;...
OpenBSD 3.94.0 - ld.so Local Environment Variable Clearing
OpenBSD 3.94.0 - ld.so Local Environment Variable Clearing / source: https://www.securityfocus.com/bid/21188/info OpenBSD is prone to a local vulnerability that may allow attackers to pass malicious environment variables to applications, bypassing expected security restrictions. Attackers may be...