UnixWare privilege escalation

Problems with procfs lead to local privilege escalation...

Insecure handling of procfs descriptors in UnixWare 7.1.1, 7.1.3 and Open UNIX 8.0.0 can lead to local privilege escalation.

----------------------------------------------------------------------- Texonet Security Advisory 20031024 ----------------------------------------------------------------------- Advisory ID : TEXONET-20031024 Authors : Joel Soderberg and Christer Oberg Issue date : Friday, October 24, 2003 Publi...

FreeBSD multiple integer overflows

Few integer overflows in procfs implementation and readv call...

[Full-Disclosure] FreeBSD Security Advisory FreeBSD-SA-03:17.procfs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-03:17.procfs Security Advisory The FreeBSD Project Topic: kernel memory disclosure via procfs Category: core Module: sys Announced: 2003-10-03 Credits: Joost Pol...

[Full-Disclosure] PINE-CERT-20030902: Integer Overflow in FreeBSD Kernel [uio]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------------- Pine Digital Security Advisory - ------------------------------------------------------------------------------- Advisory ID : PINE-CERT-20030902 Authors : Joost Pol...

CVE-2002-0820

CVE-2002-0820: FreeBSD kernels 4.6 and earlier close fds 0, 1, and 2 after they are assigned to /dev/null when the descriptors reference procfs/linprocfs. This could allow a local attacker to reuse those file descriptors in a setuid/setgid program to modify critical data and gain privileges. The ...

FreeBSD 4.x - Process Concealment Bypass

FreeBSD 4.x - Process Concealment Bypass source: https://www.securityfocus.com/bid/4768/info In FreeBSD, setting kern.psshowallprocs=0 via the sysctl call is meant to disable normal users from seeing any running processes that are not owned by them. The current implementation of this feature fail...

FreeBSD 4.x - Process Concealment Bypass

source: https://www.securityfocus.com/bid/4768/info In FreeBSD, setting kern.psshowallprocs=0 via the sysctl call is meant to disable normal users from seeing any running processes that are not owned by them. The current implementation of this feature fails to protest system process information. ...

FreeBSD-SA-02:09.fstatfs

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:09 Security Advisory FreeBSD, Inc. Topic: fstatfs race condition may allow local denial of service via procfs Category: core Module: kernel Announced: 2002-02-06 Credits:...

Security Advisory FreeBSD-SA-01:55.procfs

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:55 Security Advisory FreeBSD, Inc. Topic: procfs vulnerability leaks setugid process memory Category: core Module: procfs Announced: 2001-08-21 Credits: Joost Pol...

Очередная дырка в procfs в FreeBSD (unauthorized access)

Процесс имеющий доступ к памяти другого процесса продолжает иметь этот доступ после повышения привилегий одни из потомков процесса через exec...

FreeBSD-SA-01:55.procfs

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:55 Security Advisory FreeBSD, Inc. Topic: procfs vulnerability leaks setugid process memory Category: core Module: procfs Announced: 2001-08-21 Credits: Joost Pol Affects...

CVE-2001-0061

procfs in FreeBSD and possibly other operating systems does not properly restrict access to per-process mem and ctl files, which allows local users to gain root privileges by forking a child process and executing a privileged process from the child, while the parent retains access to the child's...

CVE-2001-0061

The CVE-2001-0061 issue affects procfs in FreeBSD (and possibly other OSes), where access to per-process mem and ctl files is not properly restricted. This lets a local attacker cause a privilege escalation by forking a child process and running a privileged executable from the child, while the p...

CVE-2001-0062

The CVE-2001-0062 entry concerns procfs in FreeBSD (and possibly other OSes) where a local user can trigger a denial of service by calling mmap on the process’ own /mem, causing the kernel to hang. Technical details across connected sources confirm the vulnerability involves the procfs mmap path ...

CVE-2001-0063

CVE-2001-0063 affects FreeBSD (procfs) and possibly other OSes; local users can bypass access controls in a jail environment to gain additional privileges (complete impact on confidentiality, integrity, and availability per NVD). The description provided does not include specific vulnerable versi...

CVE-2001-0061

procfs in FreeBSD and possibly other operating systems does not properly restrict access to per-process mem and ctl files, which allows local users to gain root privileges by forking a child process and executing a privileged process from the child, while the parent retains access to the child's...

CVE-2001-0063

procfs in FreeBSD and possibly other operating systems allows local users to bypass access control restrictions for a jail environment and gain additional privileges...

Третий раз дырка в procfs в *BSD

Третий раз с 1997 года заткнута одна и таже дырка в procfs в BSD через нее, в сочетании с удаленной дыркой, был последний раз был поломан сервер http://www.freebsd.org...

Exploiting Kernel Buffer Overflows FreeBSD Style

-----BEGIN PGP SIGNED MESSAGE----- Exploiting Kernel Buffer Overflows FreeBSD Style: Defeating Security Levels and Breaking Out of Jail2 Esa Etelavuori December 28, 2000 1. Introduction This is a detailed case study discussing the exploitation of the FreeBSD kernel process filesystem buffer...