3921 matches found
Solaris/SPARC - setuid(0) + execve (/bin/ksh) Shellcode
/ sparcsolarisexec.c - Solaris/SPARC execve shellcode Copyright c 2022 Marco Ivaldi Pretty standard Solaris/SPARC setuid/execve shellcode. Tested on: SunOS 5.10 GenericVirtual sun4u sparc SUNW,SPARC-Enterprise / char sc = / Solaris/SPARC execve shellcode 12 + 48 = 60 bytes / / setuid0 /...
Solaris/SPARC - setuid(0) + chmod (/bin/ksh) + exit(0) Shellcode
/ sparcsolarischmod.c - Solaris/SPARC chmod shellcode Copyright c 2022 Marco Ivaldi Solaris/SPARC setuid/chmod/exit shellcode. Tested on: SunOS 5.10 GenericVirtual sun4u sparc SUNW,SPARC-Enterprise / char sc = / Solaris/SPARC chmod shellcode 12 + 32 + 20 = 64 bytes / / setuid0 / "\x90\x08\x3f\xff...
openSUSE: Security Advisory for permissions (openSUSE-SU-2022:0141-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security update for permissions (moderate)
openSUSE Security Update: Security update for permissions Announcement ID: openSUSE-SU-2022:0141-2 Rating: moderate References: 1169614 Affected Products: openSUSE Leap 15.4 An update that contains security fixes can now be installed. Description: This update for permissions fixes the following...
PT-2022-37435
Name of the Vulnerable Software and Affected Versions permissions versions prior to 20181225 Description The issue concerns a problem with permissions that has been fixed by an update. The update sets the setuid bit for the cockpit session binary. Recommendations For versions prior to 20181225,...
Updated glibc packages fix security vulnerability
Updated glibc packages fix security vulnerability: An off-by-one buffer overflow and underflow in getcwd may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd in a setuid program could use this flaw to...
ROS-20220128-01
The vulnerability in the Polkit library for UNIX-like operating systems is related to improper handling of the number of call parameters in the pkexec setuid binary, which causes the binary to executes environment variables as commands. Exploitation of the vulnerability could allow an attacker to...
CVE-2021-3999
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd in a setuid program could use this flaw to potentially execute...
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
...
Exploit for Out-of-bounds Write in Polkit_Project Polkit
ez-pwnkit A pure-Go implementation of the CVE-2021-4034 Pwn...
Privilege escalation
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...
Ubuntu 16.04 ESM / 18.04 LTS : shadow vulnerabilities (USN-5254-1)
The remote Ubuntu 16.04 ESM / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5254-1 advisory. It was discovered that shadow incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or expose...
polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...
polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...
SUSE: Security Advisory (SUSE-SU-2022:0141-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2022-36626
Name of the Vulnerable Software and Affected Versions No specific software name and version are mentioned in the provided descriptions, except for a reference to an update to version 20181225. However, without explicit mention of the software name, we cannot accurately fill this section. Thus, th...
PT-2022-37434
Name of the Vulnerable Software and Affected Versions Cockpit session binary version prior to 20181225 Description The issue concerns the setuid bit for the cockpit session binary. Recommendations For versions prior to 20181225, update to version 20181225 to resolve the issue...
CVE-2021-3999
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd in a setuid program could use this flaw to potentially execute...
An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary this could lead to a local escalation of privileges.
...