dtaction.digital.unix.vuln.txt

Zack Hubert [email protected] Sent: Thursday, September 16, 1999 12:39 PM Subject: Vulnerability in dtaction on Digital Unix I have verified that the dtaction vulnerability in CDE can be exploited for local root compromise on Digital Unix systems. Background -------------- This is a followup to th...

dtspcd_vuln.txt

Subject: Vulnerability in dtspcd To: [email protected] Hello, I discovered the following security problem in dtspcd, part of CDE: Description ----------- The CDE subprocess daemon /usr/dt/bin/dtspcd contains an insufficient check on client credentials. Impact ------ The insufficient check...

dtaction_vuln.txt

Subject: Vulnerability in dtaction To: [email protected] Hello, I discovered the following security problem in dtaction, part of CDE: Description ----------- /usr/dt/bin/dtaction contains a buffer overflow when a username of more than 1024 bytes is supplied as an argument. Impact ------ T...

dtsession_vuln.txt

Subject: Vulnerability in dtsession To: [email protected] Hello, I discovered the following security problem in dtsession actually in libtt.so, part of CDE: Description ----------- The session manager dtsession contains an overflow vulnerability when parsing the environment variable...

DIGITAL UNIX 4.0 df AIX 4.3.2 CDE 2.1 IRIX 6.5.14 Solaris 7.0 SunOS 4.1.4 - Local Buffer Overflow

DIGITAL UNIX 4.0 df AIX 4.3.2 CDE 2.1 IRIX 6.5.14 Solaris 7.0 SunOS 4.1.4 - Local Buffer Overflow / source: https://www.securityfocus.com/bid/641/info TRU64/DIGITAL UNIX 4.0 d/f,AIX Somehow the overflow is very sensitive to caching of the stack. To see that it really does work, run it in a debugg...

DIGITAL UNIX 4.0 d/f / AIX 4.3.2 / CDE 2.1 / IRIX 6.5.14 / Solaris 7.0 / SunOS 4.1.4 - Local Buffer Overflow

/ source: https://www.securityfocus.com/bid/641/info TRU64/DIGITAL UNIX 4.0 d/f,AIX Somehow the overflow is very sensitive to caching of the stack. To see that it really does work, run it in a debugger and set a break point in ttopen when that is reached, set a breakpoint in sscanf and continue...

RedHat Linux 4.25.26.0 S.u.S.E Linux 6.06.1 - Cron Buffer Overflow (1)

RedHat Linux 4.25.26.0 S.u.S.E Linux 6.06.1 - Cron Buffer Overflow 1 // source: https://www.securityfocus.com/bid/602/info The version of Vixie cron that ships with RedHat versions 4.2, 5.2 and 6.0 is vulnerable to a local buffer overflow attack. By utilizing the MAILTO environment variable, a...

RedHat Linux 4.2/5.2/6.0 / S.u.S.E Linux 6.0/6.1 - Cron Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/602/info The version of Vixie cron that ships with RedHat versions 4.2, 5.2 and 6.0 is vulnerable to a local buffer overflow attack. By utilizing the MAILTO environment variable, a buffer can be overflown in the cronpopen function, allowing an attacker...

[SECURITY] Current versions of seyon may contain malicious code

One year ago, we have received a report from SGI that a vulnerability has been discovered in the seyon program which can lead to a root compromise. Any user who can execute the seyon program can exploit this vulnerability. However, the license of Seyon doesnt permit us to provide a fix, now is th...

[SECURITY] Current versions of seyon may contain malicious code

One year ago, we have received a report from SGI that a vulnerability has been discovered in the seyon program which can lead to a root compromise. Any user who can execute the seyon program can exploit this vulnerability. However, the license of Seyon doesnt permit us to provide a fix, now is th...

who.txt

Date: Tue, 28 Jul 1998 20:27:21 +0200 From: Paul Boehm Subject: who Hi, the 'who' program is on some systems in a privileged group which is allowed to read utmp. On redhat linux 5.1 you can easily crash who by many different ways e.g. try who /bin/bash on freebsd you can use it to view parts of t...

sun-snmp.txt

Vulnerabilities in Sun Solaris 2.6 SNMP Jeremy Rauch April 1998 Sun's snmpd implementation as supplied with Solaris 2.6 includes what used to be shipped with Sun's Solstice Admin suite as it's snmpd, and associated subagents. Sun's snmpd is actually pretty interesting, in that it supports a numbe...

CA-99-03-FTP-Buffer-Overflows.txt

Date: Thu, 11 Feb 1999 18:17:10 -0500 From: CERT Advisory Reply-To: [email protected] To: [email protected] Subject: CERT Advisory CA-99.03 - FTP-Buffer-Overflows -----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-99-03-FTP-Buffer-Overflows Original issue date: February 11...

cfingerd.txt

Date: Thu, 23 Jul 1998 23:48:21 -0500 From: John Goerzen Subject: CFINGERD root security hole SUMMARY ------- I have found out that cfingerd 1.3.2 contains a security hole that could lead to easy root compromise for any user that has an account on the local machine, but only if ALLOWEXECUTION is...

ftpd.txt

------------------------------------------------------------------------- Netect, Inc. General Public Security Advisory % Advisory: palmetto.ftpd % Issue date: February 9, 1999 % Revision: February 8, 1999 % Contact: Jordan Ritter Topic Remote buffer overflows in various FTP servers leads to...

snplog.bof.txt

Date: Tue, 16 Feb 1999 00:42:49 +0000 From: Rupert Weber-Henschel To: [email protected] Subject: snplog-1.0 buffer overflow There is a possible buffer overflow in snplog-1.0. Or is it 0.1? The tar file is 0.1, the docs say 1.0. % snplog contains tcplogd, icmplogd, udplogd The offending code is...

irix.x.server.font.bof.txt

Date: Mon, 8 Mar 1999 23:06:08 GMT From: SGI Security Coordinator Reply-To: [email protected] To: [email protected] Subject: X server font path buffer overflow vulnerability -----BEGIN PGP SIGNED MESSAGE----- Silicon Graphics Inc. Security Advisory Title: X server font path buffer overflow...

inn.2.x.inndstart.txt

Date: Tue, 11 May 1999 11:24:06 -0400 From: Forrest J. Cavalier III Reply-To: [email protected] To: [email protected] Subject: INN 2.0 and higher. Root compromise potential Copyright 1999 Forrest J. Cavalier III, Mib Software This information is provided by Mib Software,...

GNU groff 1.11 a HP-UX 10.011.0 SGI IRIX 6.5.3 - Malicious Manpage

GNU groff 1.11 a HP-UX 10.011.0 SGI IRIX 6.5.3 - Malicious Manpage source: https://www.securityfocus.com/bid/540/info Versions of GNU groff prior to release 1.11a and standard troff contain vulnerabilities that can possibly lead to a local root compromise if the conditions are right and...

GNU groff 1.11 a / HP-UX 10.0/11.0 / SGI IRIX 6.5.3 - Malicious Manpage

source: https://www.securityfocus.com/bid/540/info Versions of GNU groff prior to release 1.11a and standard troff contain vulnerabilities that can possibly lead to a local root compromise if the conditions are right and circumstances are somehow met. A malicious user can, in theory, embed t/g|ro...