XFree86 server overflow

XFree86 3.3.6 and probably 4.0.0 as well ; - by running X server no matter it's setuid, or called from setuid Xwrapper - works in both cases, seems to me Xwrapper in default RH 6.x distro is rather dumb ; with -xkbmap parameter and over 2100 of 'A's or shellcode, again, it's rather trivial to...

Matt Kimball and Roger Wolff mtr 0.28/0.41 / Turbolinux 3.5 b2/4.2/4.4/6.0 - mtr (2)

// source: https://www.securityfocus.com/bid/1038/info A potential vulnerability exists in the 'mtr' program, by Matt Kimball and Roger Wolff. Versions prior to 0.42 incorrectly dropped privileges on all Unix variants except HPUX. By calling a seteuidgetuid call, the authors hoped to drop...

CVE-2000-0163

asmon and ascpu in FreeBSD allow local users to gain root privileges via a configuration file...

CVE-1999-0948

CVE-1999-0948 describes a buffer overflow in the uum program for the Canna input system that allows local users to gain root privileges. This is corroborated by multiple sources (NVD, CVE List, Red Hat). The connected documents do not specify affected versions, exact root cause details beyond “bu...

rxvt.sh

There is a major security hole in rxvt, a terminal emulator for X, when it is run on systems suid root, as is required on many configurations in order to write to the utmp file. It is obvious from the code that this program was not written to be run suid root, its a pity that sysadmins that insta...

CVE-1999-0420

umapfs allows local users to gain root privileges by changing their uid through a malicious mountumap program...

BNC 2.2.4/2.4.6/2.4.8 - IRC Proxy Buffer Overflow (1)

/ source: https://www.securityfocus.com/bid/1927/info BNC's IRC Proxy is used as a gateway to an IRC server. A buffer stores a username which arguments the program's USER command. User-supplied input to this buffer is improperly checked for length. As a result, the excessive data copied onto the...

BNC 2.2.42.4.62.4.8 - IRC Proxy Buffer Overflow (2)

BNC 2.2.42.4.62.4.8 - IRC Proxy Buffer Overflow 2 / source: https://www.securityfocus.com/bid/1927/info BNC's IRC Proxy is used as a gateway to an IRC server. A buffer stores a username which arguments the program's USER command. User-supplied input to this buffer is improperly checked for length...

SGI IRIX 6.2 - 'fsdump' Local Privilege Escalation

source: https://www.securityfocus.com/bid/355/info A number of vulnerabilities exist in the fsdump program included with Silicon Graphics Inc's IRIX operating system. Each of these holes can be used to obtain root privlilege. Variant 1: irix% /var/rfindd/fsdump -L/etc/passwd -F/tmp/dump / count t...

SGI IRIX 6.2 - fsdump Local Privilege Escalation

SGI IRIX 6.2 - fsdump Local Privilege Escalation source: https://www.securityfocus.com/bid/355/info A number of vulnerabilities exist in the fsdump program included with Silicon Graphics Inc's IRIX operating system. Each of these holes can be used to obtain root privlilege. Variant 1: irix%...