Immunity Canvas: SOLARIS_TELNET

Name| solaristelnet ---|--- CVE| CVE-2007-0882 Exploit Pack| CANVAS Description| solaristelnet Notes| References: 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-102802-1', 'http://blogs.sun.com/tpenta/entry/theintelnetdvulnerabilityexploit', 'http://blogs.zdnet.com/security/?p=31',...

CVE-2006-5483

The CVE affects FreeBSD 6.1, where p1003_1b.c allows a local user to cause an unspecified denial of service by altering a scheduler policy that should be settable only by root. The underlying cause is improper access control on the scheduler policy configuration, enabling a local DoS condition. N...

Ubuntu 4.10 : linux-source-2.6.8.1 vulnerability (USN-39-1)

USN-30-1 fixed several flaws in the Linux ELF binary loader's handling of setuid binaries. Unfortunately it was found that these patches were not sufficient to prevent all possible attacks on 64-bit platforms, so previous amd64 kernel images were still vulnerable to root privilege escalation if...

Linux Kernel 2.4/2.6 bluez Local Root Privilege Escalation Exploit (update)

Exploit for linux platform in category local exploits =========================================================================== Linux Kernel 2.4/2.6 bluez Local Root Privilege Escalation Exploit update =========================================================================== / Due to many...

CVE-2004-1452

Tomcat before 5.0.27-r3 in Gentoo Linux sets the default permissions on the init scripts as tomcat:tomcat, but executes the scripts with root privileges, which could allow local users in the tomcat group to execute arbitrary commands as root by modifying the scripts...

Important: Red Hat Security Advisory: perl security update

Updated Perl packages that fix several security issues are now available for Red Hat Enterprise Linux 3. Perl is a high-level programming language commonly used for system administration utilities and Web programming. Kevin Finisterre discovered a stack based buffer overflow flaw in sperl, the Pe...

cdrtools: Local root vulnerability in cdrecord if set SUID root

Background The cdrtools package is a set of tools for CD recording, including the popular cdrecord command-line utility. Description Max Vozeler discovered that the cdrecord utility, when set to SUID root, fails to drop root privileges before executing a user-supplied RSH program. By default,...

Debian proftpd root Privilege Escalation

Binary data 1817.prm...

Mandrake Linux Security Advisory : sudo (MDKSA-2002:003)

The SuSE Security Team discovered a vulnerability in sudo that can be exploited to obtain root privilege because sudo is installed setuid root. An attacker could trick sudo to log failed sudo calls executing the sendmail or equivalent mailer program with root privileges and an environment that is...

Mandrake Linux Security Advisory : tcltk (MDKSA-2002:060)

Some problems were discovered with the Tcl/Tk development environment. The expect application would search for its libraries in /var/tmp prior to searching in other directories, which could allow a local user to gain root privilege by writing a trojan library and waiting for the root user to run...

CVE-2004-0077

The domremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the domunmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different...

Important: Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes

Updated XFree86 packages for Red Hat Linux 9 provide security fixes to font libraries and XDM. XFree86 is an implementation of the X Window System providing the core graphical user interface and video drivers in Red Hat Linux. XDM is the X display manager. Multiple integer overflows in the transf...

[SECURITY] [DSA-385-1] New hztty packages fix buffer overflows

-------------------------------------------------------------------------- Debian Security Advisory DSA 385-1 [email protected] http://www.debian.org/security/ Matt Zimmerman September 18th, 2003 http://www.debian.org/security/faq -...

DSA-332 linux-kernel-2.4.17 - several vulnerabilities

Bulletin has no description...

Multiple Sun Database Functions Buffer Overflow Vulnerabilities

Description Sun dbmopen, ndbm, dbm and dbminit library functions have been reported prone to buffer overflow vulnerabilities. Each of these issues likely present themselves due to a lack of sufficient bounds checking performed when copying externally supplied data into an internal memory buffer...

Qpopper 4.0.x - 'poppassd' Privilege Escalation

/ Title: Qpopper v4.0.x poppassd local root exploit. Exploit code: 0x82-Local.Qp0ppa55d.c -- ./0x82-Local.Qp0ppa55d -u x82 -p mypasswd Qpopper v4.0.x poppassd local root exploit. by Xpl017Elz / include include include include define BUFSZ 0x82 define DPOPPASS "/usr/local/bin/poppassd" define DNAM...

CVE-2002-0754

Kerberos 5 su k5su in FreeBSD 4.4 and earlier relies on the getlogin system call to determine if the user running k5su is root, which could allow a root-initiated process to regain its privileges after it has dropped them...

CVE-2002-0442

The CVE-2002-0442 relates to a buffer overflow in the dlvr_audit component of Caldera OpenServer versions 5.0.5 and 5.0.6. Exploitation would allow local users to escalate privileges to root. The provided documents confirm the affected product, vulnerable function, and outcome (local privilege es...

NSFOCUS SA2003-02: Solaris lpq Stack Buffer Overflow Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NSFOCUS Security AdvisorySA2003-02 Topic: Solaris lpq Stack Buffer Overflow Vulnerability Release Date: 2003-3-31 CVE CAN ID: CAN-2003-0091 Affected system: =================== Sun Solaris 2.5.1 SPARC/x86 Sun Solaris 2.6 SPARC/x86 Sun Solaris 7...

Traceroute-nanog 6 - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/6166/info A vulnerability has been discovered in Traceroute-nanog. It has been reported that Traceroute-nanog contains a buffer overflow condition. The overflow occurs in the 'getorigin' function in the 'traceroute.c' file. Due to insufficient bounds...