Microsoft SQL 2000/7.0 - Agent Jobs Privilege Escalation

source: https://www.securityfocus.com/bid/5483/info Microsoft SQL Server 2000 uses an Agent which is responsible for restarting the SQL Server service, replication, and running scheduled jobs. Some of the jobs that the Agent executes have weak permissions, which could allow a user with low...

FreeBSD 4.x NetBSD 1.4.x1.5.x1.6 OpenBSD 3 - pppd Arbitrary File Permission Modification Race Condition

FreeBSD 4.x NetBSD 1.4.x1.5.x1.6 OpenBSD 3 - pppd Arbitrary File Permission Modification Race Condition source: https://www.securityfocus.com/bid/5355/info A vulnerability has been reported in some versions of the pppd daemon included with multiple BSD distributions. A race condition error in the...

Linux Kernel 2.4.18/2.4.19 - Privileged File Descriptor Resource Exhaustion (Denial of Service)

/ source: https://www.securityfocus.com/bid/5178/info The Linux kernel is a freely available, open source kernel originally written by Linus Torvalds. It is the core of all Linux distributions. Recent versions of the Linux kernel include a collection of file descriptors which are reserved for usa...

FreeBSD-SA-01:62.uucp

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:62 Security Advisory FreeBSD, Inc. Topic: UUCP allows local root exploit Category: core Module: uucp Announced: 2001-10-08 Credits: [email protected] Affects: All release...

SpeechD 0.10.2 - Privileged Command Execution

SpeechD 0.10.2 - Privileged Command Execution source: https://www.securityfocus.com/bid/3326/info SpeechD is a device-independent layer for speech synthesis under Linux, providing an interface for speech-based applications or device drivers. SpeechD has been found to contain a flaw under certain...

Midnight Commander

The Midnight Commander 4.5.51 latest. $ od -t x1 mcbug 0000000 03 14 77 04 0a $ mkdir cat mcbug $ mc try to view this directory - 'w' - 0x77 command will be executed; longer commands might be used, as well Obviously, this attack requires privledged user interaction. Midnight Commander won't displ...

Slackware Linux - '/usr/bin/ppp-off' Insecure /tmp Call

!/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp. Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any fileie: /etc/issue, thus when root runs the ppp-off script, the output of 'ps x' woul...

OpenBSD Exploit

HP2 advisory HP2 advisory HP2 advisory HP2 advisory HP2 advisory - | | | www.hackphreak.org | | | | Version : Hackphreak advisory 2 of many | | Author : RLoxleyhackphreak / condemnation / EHAP / RSH / ZSH soon| | Contributed : All of Team Hackphreak thanks alot & SSG | | Topic : A non-privledged...

Solaris 2.67.0 locale - Subsystem Format String

Solaris 2.67.0 locale - Subsystem Format String / source: https://www.securityfocus.com/bid/1634/info nectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems provi...

Solaris 2.6/7.0 'eject' locale - Subsystem Format String

/ source: https://www.securityfocus.com/bid/1634/info nectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems provide internationalization support according to the...

Solaris 2.67.0 eject locale - Subsystem Format String

Solaris 2.67.0 eject locale - Subsystem Format String / source: https://www.securityfocus.com/bid/1634/info nectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems...

aix allows clearing the interface stats

hallo, aix versions 4.x.x will let a non-priveledged user clear the network interface statistics, thus annoying system administrators and interfering with the system scripts that depend on those numbers :- $ netstat -in -- shows stats $ netstat -Zi -- clears them without checking the uid ibm was...

Immunix OS 6.2 - LC glibc format string

Immunix OS 6.2 - LC glibc format string / source: https://www.securityfocus.com/bid/1634/info nectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems provide...

Libc locale - Local Privilege Escalation (2)

Libc locale - Local Privilege Escalation 2 / source: https://www.securityfocus.com/bid/1634/info ectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems provide...

UNICOS 9MAX 1.3mk 1.5 AIX 4.2 libc 5.2.18 RedHat 4 IRIX 6 Slackware 3 - NLS (1)

UNICOS 9MAX 1.3mk 1.5 AIX 4.2 libc 5.2.18 RedHat 4 IRIX 6 Slackware 3 - NLS 1 / source: https://www.securityfocus.com/bid/711/info Cray UNICOS 9.0/9.2/MAX 1.3/mk 1.5,AIX = 4.2,Linux libc = 5.2.18,RedHat 4.0,IRIX 6.2,Slackware 3.1 Natural Language Service NLS Vulnerability 1 A buffer overflow...