snmpXdmid overflow

The remote RPC service 100249 snmpXdmid is vulnerable to a heap overflow which allows any user to obtain a root shell on this host. SPDX-FileCopyrightText: 2001 Intranode Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

poppassd-lnx.sh.txt

!/bin/sh Linux Qpopper poppassd latest version local r00t exploit by kcope August 2005 Confidential - Keep Private! POPPASSDPATH=/usr/local/bin/poppassd echo "" echo "Linux Qpopper poppassd latest version local r00t exploit by kcope" echo "" sleep 2 umask 0000 if -f /etc/ld.so.preload ; then echo...

Qpopper 4.0.8 (FreeBSD) - Local Privilege Escalation

Qpopper 4.0.8 FreeBSD - Local Privilege Escalation !/bin/sh FreeBSD Qpopper poppassd latest version local r00t exploit by kcope tested on FreeBSD 5.4-RELEASE POPPASSDPATH=/usr/local/bin/poppassd HOOKLIB=libutil.so.4 echo "" echo "FreeBSD Qpopper poppassd latest version local r00t exploit by kcope...

Qpopper 4.0.8 (Linux) - 'poppassd' Local Privilege Escalation

!/bin/sh tested and working /str0ke Linux Qpopper poppassd latest version local r00t exploit by kcope August 2005 Confidential - Keep Private! POPPASSDPATH=/usr/local/bin/poppassd echo "" echo "Linux Qpopper poppassd latest version local r00t exploit by kcope" echo "" sleep 2 umask 0000 if -f...

Operator Shell (osh) 1.7-13 Local Root Exploit

No description provided by source. You must be groupoperator for permissions /str0ke !/usr/bin/perl OSH 1.7 Exploit 2 Gonna bang away at this until it's removed ;- EDUCATIONAL purposes only.... :- by Charles Stevenson core [email protected] Description: The Operator Shell Osh is a setuid root,...

[SECURITY] [DSA 725-2] New ppxp packages fix local root exploit

-------------------------------------------------------------------------- Debian Security Advisory DSA 725-2 [email protected] http://www.debian.org/security/ Martin Schulze July 4th, 2005 http://www.debian.org/security/faq -...

[ Suresec Advisories ] - Mac OS X 10.4 - launchd local root vulnerability

Securesec Security Advisory - 00003 09/06/05 Apple Mac OS X 10.4 launchd race condition vulnerability Advisory: http://www.suresec.org/advisories/adv3.pdf Description: A race condition vulnerability has been found in the temporary file creation done by the suid launchd program on Mac OSX 10.4. Th...

[SECURITY] [DSA 725-1] New ppxp packages fix local root exploit

-------------------------------------------------------------------------- Debian Security Advisory DSA 725-1 [email protected] http://www.debian.org/security/ Martin Schulze May 19th, 2005 http://www.debian.org/security/faq -...

AdobeMac.txt

Note: Sorry if this is a dupe, I might of sent it to the wrong address. Local root exploit on Mac OS X 10.3.6 with Adobe products installed Found by Jonathan Bringhurst Summary: It's possible to create a suid root shell with a non-privileged user on a Mac OS X 10.3.6 system with Adobe Version Cue...

Local root exploit on Mac OS X with Adobe Version Cue

Note: Sorry if this is a dupe, I might of sent it to the wrong address. Local root exploit on Mac OS X 10.3.6 with Adobe products installed Found by Jonathan Bringhurst [email protected] Summary: It's possible to create a suid root shell with a non-privileged user on a Mac OS X 10.3.6 syst...

Socat 1.4.0.2 - Not SETUID Local Format String

/ socatexp.c Socat Format String Vulnerability socat No System Group - http://www.nosystem.com.ar coki@servidor:$ make socatexp coki@servidor:$ ./socatexp socat shellcode address = 0xbfffffb9 .dtors address = 0x080740c4 2004/10/19 09:49:46 socat26197 E unknown syslog facility...

Motorola Wireless Router WR850G Authentication Circumvention

------------------------------------------------------------------------- | Motorola Wireless Router WR850G Authentication Circumvention | ------------------------------------------------------------------------- Date: 09-23-2004 Author: Daniel Fabian Product: Motorola Wireless Router WR850G,...

CDRDAO - Local Privilege Escalation

!/bin/sh DIR=pwd echo "" echo "cdrdao local root exploit - gr doesn't protect you this time" echo "Karol Wiêsek " echo "" sleep 2 umask 000 echo -n " Checking if /etc/ld.so.preload doesn't exist ... " if -f /etc/ld.so.preload ; then echo "WRONG" echo "/etc/ld.so.preload exists, write another...

NETGEAR DG834G SPECIAL FEATURES

By opening http://192.168.0.1/setup.cgi?todo=debug you enable the router's debug mode.Then you just telnet at 192.168.0.1 at port 23 and then you have a root shell. Also i found that if you just telnet to 192.168.0.1 2602 you will get a prompt from the service ZEBRA that is running on the router....

netgearDG834G.txt

By opening http://192.168.0.1/setup.cgi?todo=debug you enable the router's debug mode.Then you just telnet at 192.168.0.1 at port 23 and then you have a root shell. Also i found that if you just telnet to 192.168.0.1 2602 you will get a prompt from the service ZEBRA that is running on the router....

Mandrake Linux Security Advisory : proftpd (MDKSA-2003:095-1)

A vulnerability was discovered by X-Force Research at ISS in ProFTPD's handling of ASCII translation. An attacker, by downloading a carefully crafted file, can remotely exploit this bug to create a root shell. The ProFTPD team encourages all users to upgrade to version 1.2.7 or higher. The...

Mandrake Linux Security Advisory : usermode (MDKSA-2003:031-1)

The /usr/bin/shutdown command that comes with the usermode package can be executed by local users to shutdown all running processes and drop into a root shell. This command is not really needed to shutdown a system, so it has been removed and all users are encouraged to upgrade. Please note that...

eSeSIX Thintune thin client multiple vulnerabilities

eSeSIX Thintune thin client multiple vulnerabilities IT-Consult, 2004-07-24 Background - -------- Thintune is a series of thin client appliances sold by eSeSIX GmbH, Germany. They offer ICA, RDP, X11 and SSH support based on a customized Linux platform. See http://www.thintune.com for details...

eSeSIX.txt

eSeSIX Thintune thin client multiple vulnerabilities IT-Consult, 2004-07-24 Background - -------- Thintune is a series of thin client appliances sold by eSeSIX GmbH, Germany. They offer ICA, RDP, X11 and SSH support based on a customized Linux platform. See http://www.thintune.com for details...

Immunity Canvas: PSERVERD

Name| pserverd ---|--- CVE| CVE-2004-0396 Exploit Pack| CANVAS Description| CVS pserverd Notes| CVE Name: CVE-2004-0396 VENDOR: nongnu.org Notes: This overflow impacts CVS feature versions 1.12.7 and earlier, and stable versions 1.11.15 https://vulners.com/cve/CVE-2004-0396. ab note: cvsd running...