KDE 1.1.2 KApplication configfile - Local Privilege Escalation (2)

source: https://www.securityfocus.com/bid/1291/info The KDE configuration-file management has a bug which could result in root compromise. Due to insecure creation of configuration rc files via KApplication-class, local users can modify ownership of arbitrary files when running setuid root...

KDE 1.1.2 KApplication configfile - Local Privilege Escalation (3)

KDE 1.1.2 KApplication configfile - Local Privilege Escalation 3 source: https://www.securityfocus.com/bid/1291/info The KDE configuration-file management has a bug which could result in root compromise. Due to insecure creation of configuration rc files via KApplication-class, local users can...

RedHat Linux 6.x - X Font Server Buffer Overflow (Denial of Service)

RedHat Linux 6.x - X Font Server Buffer Overflow Denial of Service // source: https://www.securityfocus.com/bid/1111/info A denial of service exists in the X11 font server shipped with RedHat Linux 6.x. Due to improper input validation, it is possible for any user to crash the X fontserver. This...

FreeBSD-SA-00:12.healthd

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:12 Security Advisory FreeBSD, Inc. Topic: healthd allows a local root compromise Category: ports Module: healthd Announced: 2000-04-10 Credits: Discovered during FreeBSD...

Local root compromise in GNQS 3.50.6 and 3.50.7

A large security hole was uncovered last month in Generic-NQS ver. 3.50.6 and 3.50.7. This hole leads to immediate local root compromise. All users of those versions are requested to upgrade to ver. 3.50.8 or later ASAP. The updated package can be downloaded from...

FreeBSD-SA-00:10.orville-write

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:10 Security Advisory FreeBSD, Inc. Topic: orville-write port contains local root compromise. Category: ports Module: orville-write Announced: 2000-03-15 Affects: Ports...

FreeBSD-SA-00:02.procfs

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:01 Security Advisory FreeBSD, Inc. Topic: Old procfs hole incompletely filled Category: core Module: make Announced: 2000-01-24 Affects: All versions before the correctio...

Corel Linux OS 1.0 - get_it PATH

source: https://www.securityfocus.com/bid/928/info A component of the "Corel Update" utility distributed with Corel's Linux OS is vulnerable to a local PATH vulnerability. The binary "getit", which is stored in /usr/X11R6/bin, is setuid root installed by default on all Corel LinuxOS systems it's...

Corel Linux OS 1.0 - get_it PATH

Corel Linux OS 1.0 - getit PATH source: https://www.securityfocus.com/bid/928/info A component of the "Corel Update" utility distributed with Corel's Linux OS is vulnerable to a local PATH vulnerability. The binary "getit", which is stored in /usr/X11R6/bin, is setuid root installed by default on...

unixware.pis.txt

Greetings, OVERVIEW A vulnerability in "/usr/local/bin/pis" on SCO UnixWare will allow any user to create arbitrary files with group "sys" privileges. A full root compromise is then trivial. BACKGROUND As usual, I've only tested UnixWare 7.1. DETAILS By creating a symlink between /tmp/pisdata and...

IBM Network Station Manager 2.0 R1 - Race Condition

IBM Network Station Manager 2.0 R1 - Race Condition // source: https://www.securityfocus.com/bid/900/info IBM's Network Station Manager is a client/server application which facilitates management for IBM Network Stations. It is possible to locally gain root priviliges on hosts running the...

Solaris 2.5/2.5.1/2.6/7.0 - 'sadmind' Remote Buffer Overflow (4)

// source: https://www.securityfocus.com/bid/866/info Certain versions of Solaris ship with a version of sadmind which is vulnerable to a remotely exploitable buffer overflow attack. sadmind is the daemon used by Solstice AdminSuite applications to perform distributed system administration...

unixware.pkg.exploits.txt

Greetings, OVERVIEW Most of UnixWare's pkg commands can be exploited to print /etc/shadow, leading to a probable root compromise. BACKGROUND Only tested on UnixWare 7.1. DETAILS The permissions for the UnixWare pkg commands are as follows: bash-2.02$ ls -la /usr/sbin/pkgchk /usr/bin/pkginfo...

FreeBSD 3.3 - gdc Local Buffer Overflow

FreeBSD 3.3 - gdc Local Buffer Overflow // source: https://www.securityfocus.com/bid/834/info There is a buffer overflow vulnerability known to be present in the version of gdc shipped with the 3.3-RELEASE version of FreeBSD. By default, only users in group wheel have execute access to gdc. The...

FreeBSD 3.3 - 'gdc' Local Buffer Overflow

// source: https://www.securityfocus.com/bid/834/info There is a buffer overflow vulnerability known to be present in the version of gdc shipped with the 3.3-RELEASE version of FreeBSD. By default, only users in group wheel have execute access to gdc. The overflow occurs when the argument passed...

Qualcomm qpopper 3.0/3.0 b20 - Remote Buffer Overflow (2)

source: https://www.securityfocus.com/bid/830/info There is a buffer overflow vulnerability present in current 3.x versions of Qualcomm popper daemon. These vulnerabilities are remotely exploitable and since the daemon runs as root, the host running qpopper can be completely compromised...

Solaris 7.0 - 'kcms_configure' Local Overflow / Local Privilege Escalation

/ source: https://www.securityfocus.com/bid/831/info The binary kcmsconfigure, part of the Kodak Color Management System package shipped with OpenWindows and ultimately, Solaris is vulnerable to a local buffer overflow. The buffer which the contents of the environment variable NETPATH are copied...

SCO Unixware 7.0 - xlock(1) Username Local Buffer Overflow

SCO Unixware 7.0 - xlock1 Username Local Buffer Overflow // source: https://www.securityfocus.com/bid/825/info Certain versions of Unixware ship with a version of xlock which is vulnerable to a buffer overflow attack. The xlock1 program locks the local X display until a username and password are...

SCO Unixware 7.0 - 'xlock(1)' 'Username' Local Buffer Overflow

// source: https://www.securityfocus.com/bid/825/info Certain versions of Unixware ship with a version of xlock which is vulnerable to a buffer overflow attack. The xlock1 program locks the local X display until a username and password are entered. In this instance a user can provide an overly lo...

ISC BIND 8.2.2 IRIX 6.5.17 Solaris 7.0 - NXT Overflow Denial of Service

ISC BIND 8.2.2 IRIX 6.5.17 Solaris 7.0 - NXT Overflow Denial of Service // source: https://www.securityfocus.com/bid/788/info There are several vulnerabilities in recent BIND packages pre 8.2.2. The first is a buffer overflow condition which is a result of BIND improperly validating NXT records...