OpenBSD - 'ftp' Local Overflow

/ 7350-crocodile - x86/OpenBSD ftp exploit by lorian and scut / TESO=20 TESO CONFIDENTIAL - SOURCE MATERIALS This is unpublished proprietary source code of TESO Security. The contents of these coded instructions, statements and computer programs may not be disclosed to third parties, copied or...

CVE-2001-1559

The uipc system calls uipcsyscalls.c in OpenBSD 2.9 and 3.0 provide user mode return instead of versus rval kernel mode values to the fdrelease function, which allows local users to cause a denial of service and trigger a null dereference...

PT-2001-2644 · Openbsd · Openbsd

Name of the Vulnerable Software and Affected Versions: OpenBSD versions 2.9 through 3.0 Description: The issue allows local users to cause a denial of service and trigger a null dereference due to the uipc system calls providing user mode return instead of kernel mode values to the fdrelease...

ATPhttpd 0.4 DoS Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ATPhttpd 0.4 DoS Vulnerability Type: DoS, crashes Daemon Release Date: December 13, 2001 Product / Vendor: ATPhttpd, the tiny, caching, high performance webserver. ATPhttpd is ideal for serving lots of static content, especially where disk I/O is...

UseLogin.txt

-- OpenSSH UseLogin bug proof of concept exploit -- by WaR / http://www.genhex.org -- Intro -- I was very curious in finding out how to exploit this problem. Although I don't think anyone uses this feature, I looked into the matter anyway. Here it goes. It was tested on the following platforms: -...

OpenBSD 2.x3.0 - User Mode Return Value Denial of Service

OpenBSD 2.x3.0 - User Mode Return Value Denial of Service // source: https://www.securityfocus.com/bid/3612/info OpenBSD is a freely available implementation of the BSD Operating System. It is based on the NetBSD implementation. Under some conditions, an application launched by a regular user on...

OpenBSD local DoS

-----BEGIN PGP SIGNED MESSAGE----- A local denial of service attack against OpenBSD was published today Sunday Dec 02 to the [email protected] mailing list by Marco Peereboom [email protected]. I'm forwarding his message on to the general security community. The effect of the attack is to crash...

Локальный DoS против OpenBSD

Открытие pipe с нулевым указателем приводит к краху систему...

OpenBSD 2.x/3.0 - User Mode Return Value Denial of Service

// source: https://www.securityfocus.com/bid/3612/info OpenBSD is a freely available implementation of the BSD Operating System. It is based on the NetBSD implementation. Under some conditions, an application launched by a regular user on the system can cause a system crash. When an application o...

CVE-2001-1415

vi.recover in OpenBSD before 3.1 allows local users to remove arbitrary zero-byte files such as device nodes...

Проблемамы с сигналами в OpenBSD

При вызове accept над сокетом переданным другому процессу сбрасывается информация о владельце сокета, что позволяет генерировать сигналы SIGIO, SIGURG для процесса-владельца...

OpenBSD bug

Hi I recently found a vulnerability in OpenBSD kernel that allows any user capable of executing a process to deliver SIGURG and SIGIO signals to any process or group of process owned by any user in the system. Although the default behaviour in OpenBSD is to ignore these signals, this issue could ...

CVE-2001-0378

CVE-2001-0378 affects OpenBSD readline prior to 4.1 (OpenBSD 2.8 and earlier). The vulnerability stems from creating readline history files with insecure permissions, allowing a local attacker to recover potentially sensitive information via history files. The NVD metrics list a base score of 2.1...

CVE-2001-0378

readline prior to 4.1, in OpenBSD 2.8 and earlier, creates history files with insecure permissions, which allows a local attacker to recover potentially sensitive information via readline history files...

CVE-2001-0378: Undefined Security Weakness

readline prior to 4.1, in OpenBSD 2.8 and earlier, creates history files with insecure permissions, which allows a local attacker to recover potentially sensitive information via readline history files...

CVE-2001-1145

fts routines in FreeBSD 4.3 and earlier, NetBSD before 1.5.2, and OpenBSD 2.9 and earlier can be forced to change chdir into a different directory than intended when the directory above the current directory is moved, which could cause scripts to perform dangerous actions on the wrong directories...

openbsdrace.txt

[email protected] Georgi Guninski security advisory 47, 2001 OpenBSD 2.9,2.8 local root compromise Systems affected: OpenBSD 2.9,2.8 Have not tested on other OSes but they may be vulnerable Risk: High Date: 14 June 2001 Legal Notice: This Advisory is Copyright c 2001 Georgi Guninski. You may...

CVE-2001-0378

readline prior to 4.1, in OpenBSD 2.8 and earlier, creates history files with insecure permissions, which allows a local attacker to recover potentially sensitive information via readline history files...

OpenBSD 2.9,2.8 local root compromise

Return-Path: pent.sci-nnov.ru!securityfocus.com!bugtraq-return-420-vlad=sandy.ru Received: from adm.sci-nnov.ru adm.sci-nnov.ru 193.125.71.2 by pent.sci-nnov.ru 8.11.3/Dmiter-4.1-AGK-1.1 with ESMTP id f5EFXH490671 for [email protected]; Thu, 14 Jun 2001 19:33:17 +0400 MSD Received: from...

Locally exploitable races in OpenBSD VFS

my apologies if it ends up submitted twice Let's start with the trivial: good old aliasing bugs. Example 1: dup2 vs. close. Relevant file: kern/kerndescrip.c sysdup2p, v, retval struct proc p; void v; registert retval; snip if uintold = fdp-fdnfiles || fdp-fdofilesold == NULL || uintnew =...