ISS X-Force response

This vulnerability was originally detected auditing the Apache 2.0 source tree. Apache 2.0 uses the same function to determine the chunk size, and has the same vulnerable signed comparison. It is, however, not vulnerable by luck? due to a signed comparison deep within the buffered reading routine...

TRU64 /bin/chsh overflow

oops forgot one ... more soon. = /bin/chsh perl -e 'print "A" x 9000' Segmentation fault uname -a OSF1 alpha.snosoft.com V5.1 732 alpha ls -al /bin/chsh -rws--x--x 3 root bin 32944 Aug 24 2000 /bin/chsh dbx ./chsh core dbx version 5.1 Type 'help' for help. Core file created by program "chsh"...

Sar -o exploitation process info.

Caldera recently released an update for the suid sar binary. At one point in time someone pointed out that sar -f had an overflow Brok Tellier or k2 probably I can't remember. The -f overflow was fixed but the -o option which I have seen in private security advisorys floating around also had an...

Happy Easter / April Fools from Snosoft (Oracle 8.1.5 tnslsnr)

This is ment to be an April fools joke but if you still use old Oracle its not to funny I guess: After I ate a few too many hard boiled eggs this weekend I decided to install Oracle and play with it a little. Being poor I didn't have 800 bones to shell out on Oracle 16i so I had to settle with...

Progress Software suid overflows again.

Yet another b0f in progress software due to pstcopy Progress Software corp. http://www.progress.com STILL can't seem to validate user input... this is in their latest patch level for Progress 9.1C 91C09.tar.Z root@localhost bin cat ../version echo PROGRESS PATCH Version 9.1C09 as of February 26,...

compress(vul) + ftpd(?)

hyph@port $ rpm -qf which compress ncompress-4.2.4-21 hyph@port $ compress perl -e 'print "A" x 1100' AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...

Censoft TERM Emu bOf

Vendor: www.censoft.com Product: TERM for UNIX / Linux Emulations Wyse 60, SCO ANSI, VT220 Terminal Supports SCO, AIX, HP, DEC, Solaris Operating Environmenttm software, and Linuxtm I WAS going to purchase this product after trying the eval however I changed my mind for some reason...I would...

Re: slocate bug.

Heres the details on Mandrake Linux elguapo@linux elguapo$ ls -al which slocate -rwxr-sr-x 2 root slocate 24956 Apr 6 2001 /usr/bin/slocate elguapo@linux elguapo$ uname -a Linux linux.ckfr.com 2.4.3-20mdk 1 Sun Apr 15 23:03:10 CEST 2001 i686 unknown elguapo@linux elguapo$ cat /etc/redhat-release...

slocate bug.

Hey, Its a good time to announce that 2xs security LTD. decided to create a research team in order to focus on finding new bugs, further more we managed to develop a security tool to discover bugs/security flaws. In the near future, the tool itself will became an open source project. slocate Secu...

dnrd 2.10 dos

Program: dnrd Version: 2.10 Distro: n/a Problem: There are various problems with dnrd's dns request and reply functions, that cause it to crash. Reproduce: Using two consoles, I did the following Terminal one got: andrewg@blackhole /data/audit/dnrd-2.10/src$ gdb dnrd GNU gdb 5.0rh-5 Red Hat Linux...

'/usr/bin/at 31337 + vuln' problem + exploit

Affects: /usr/bin/at To check if you are potentially vulnerable to this exploit, execute: /usr/bin/at 31337 + vuln If you are vulnerable this will cause: Segmentation fault If not, there will be a message similar to: Garbled time possibly with some extra information The problem is caused by a bug...

Clanlib overflow / Super Methane Brothers overflow

Charles stayed up all night and found a hole in Eterm so I felt obligated to stay up all night and find something else wrong on my box too. In doing so I found an overflow in a game included with Mandrake 8.1 called Super Methane Brothers. $HOME=bof here then run /usr/games/methane. Inturn that...

artsd overflow

-----BEGIN PGP SIGNED MESSAGE----- Happy new year. Take a look at this: r00t:$ ls -las which artswrapper which artsd 4 -rwsr-xr-x 1 root root 4048 Dec 28 22:43 /usr/bin/artswrapper 120 -rwxr-xr-x 1 root root 117644 Dec 28 22:43 /usr/bin/artsd r00t:$ artsd -m perl -e 'print...

Buffer overflow vulnerability in grpck command line utility

Overview The CERT/CC has received a public report of a local buffer overflow vulnerability in the grpck utility. Description The grpck utility performs syntax checking of /etc/group and /etc/gshadow group information files. This utility contains a buffer overflow vulnerability in the section of...

Buffer overflow in Python code

Hi, I've found buffer overflow in Python 2.1.1 source code. Maybe there're many others The buffer overflow is in the file traceback.c in the directory Python of the Python source code. Simply there's a sprintf done in this way: sprintflinebuf,FMT,filename,lineno,name What cause the overflow is th...

gm4 format strings on OSX

This in itself is not an issue due to the lack of a suid bit... however if I remember correctly there were a few linux suid root binaries that were reliant upon m4 in some way or another thus making them vulnerable to a local root expoit. This is on osx 10.1. OSXBOX: elguapo ls -al which m4...

OpenUNIX 8 & Unixware possible local root

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Another dt series bug... $ uname -a OpenUNIX zen 5 8.0.0 i386 x86at Caldera UNIXSVR5 $ id uid=101fixxxer gid=1other $ ls -al /usr/dt/bin/dtterm - -r-sr-xr-x 1 root bin 60892 Haz 10 05:03 /usr/dt/bin/dtterm $ /usr/dt/bin/dtterm -tn perl -e 'print...

CVE-1999-1448

Affected software: Eudora and Eudora Light before 3.05. Vulnerable component: e-mail processing using dates in messages. Root cause: certain dates cause Divide By Zero errors (dates before 1970) or segmentation faults (dates ~100 years after current date). Impact: remote attacker could cause a cr...

suid xman 3.1.6 overflows

xman from at least X11R6-contrib-3.3.2-3.i386.rpm suffers from a classic overflow [email protected] is noted as the packager of this RPM. I do not know the author. root@linux lib ls -al which xman -rwxr-sr-x 1 root man 41076 Jun 17 1998 /usr/X11R6/bin/xman root@linux lib xman root@linux li...

Sun SunVTS 4.x - PTExec Buffer Overflow

source: https://www.securityfocus.com/bid/2898/info SunVTS is the Sun Validation Test Suite, distributed and maintained by Sun Microsystems. The SunVTS is used to test various components of OEM Sun hardware, and can also be used to stress-test components and sub-components. A buffer overflow in t...