3393 matches found
CVE-2016-9638
In BMC Patrol before 9.13.10.02, the binary "listguests64" is configured with the setuid bit. However, when executing it, it will look for a binary named "virsh" using the PATH environment variable. The "listguests64" program will then run "virsh" using root privileges. This allows local users to...
DavFS2: Local privilege escalation
Background DavFS2 is a file system driver that allows you to mount a WebDAV server as a local disk drive. Description DavFS2 installs “/usr/sbin/mount.davfs” as setuid root. This utility uses “system” to call “/sbin/modprobe”. While the call to “modprobe” itself cannot be manipulated, a local...
CVE-2016-2984
IBM Spectrum Scale 4.1.1.x before 4.1.1.8 and 4.2.x before 4.2.0.4 and General Parallel File System GPFS 3.5.x before 3.5.0.32 and 4.1.x before 4.1.1.8 allow local users to gain privileges via crafted command-line parameters to a /usr/lpp/mmfs/bin/ setuid program...
CVE-2016-2984
IBM Spectrum Scale 4.1.1.x before 4.1.1.8 and 4.2.x before 4.2.0.4 and General Parallel File System GPFS 3.5.x before 3.5.0.32 and 4.1.x before 4.1.1.8 allow local users to gain privileges via crafted command-line parameters to a /usr/lpp/mmfs/bin/ setuid program...
Design/Logic Flaw
IBM Spectrum Scale 4.1.1.x before 4.1.1.8 and 4.2.x before 4.2.0.4 and General Parallel File System GPFS 3.5.x before 3.5.0.32 and 4.1.x before 4.1.1.8 allow local users to gain privileges via crafted command-line parameters to a /usr/lpp/mmfs/bin/ setuid program...
Palo Alto Networks PanOS root_trace - Privilege Escalation Vulnerability
Exploit for linux platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=912 The setuid root executable /usr/local/bin/roottrace essentially just does setuid0 then system"/usr/local/bin/masterd", which is a python script: $ ls -l...
Palo Alto Networks PanOS root_reboot - Privilege Escalation Vulnerability
Exploit for linux platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=913 This was fixed by PAN: http://securityadvisories.paloaltonetworks.com/Home/Detail/67 The rootreboot utility is setuid root, but performs multiple calls to system with attack...
Palo Alto Networks PanOS - 'root_trace' Local Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=912 The setuid root executable /usr/local/bin/roottrace essentially just does setuid0 then system"/usr/local/bin/masterd", which is a python script: $ ls -l /usr/local/bin/roottrace -rwsr-xr-x 1 root root 12376 Oct 17 2014...
Palo Alto Networks PanOS - root_reboot Local Privilege Escalation
Palo Alto Networks PanOS - rootreboot Local Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=913 This was fixed by PAN: http://securityadvisories.paloaltonetworks.com/Home/Detail/67 The rootreboot utility is setuid root, but performs multiple calls to system...
GLSA-201611-10 : libuv: Privilege escalation
The remote host is affected by the vulnerability described in GLSA-201611-10 libuv: Privilege escalation It was discovered that libuv does not call setgroups before calling setuid/setgid. If this is not called, then even though the uid has been dropped, there may still be groups associated that...
LifeSize Room 5.0.9 - Multiple Vulnerabilities
LifeSize Room 5.0.9 - Multiple Vulnerabilities Source: https://github.com/XiphosResearch/exploits/tree/master/deathsize LifeSize Room 5.0.9, remote config disclosure, code execution & local privilege escalation Ultimately the Lifesize Room products have fundamentally flawed firmware, many similar...
PT-2019-16759 · Linux +3 · Linux Kernel +3
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.8 Description: A race condition in the perf event open function allows local attackers to leak sensitive data from setuid programs. This occurs because no relevant locks, specifically the cred guard mutex, are...
[SECURITY] [DLA 680-2] bash version number correction
Package : bash Version : 4.2+dfsg-0.1+deb7u4 CVE ID : CVE-2016-7543 This is a correction of DLA 680-1 that mentioned that bash 4.2+dfsg-0.1+deb7u3 was corrected. The corrected package version was 4.2+dfsg-0.1+deb7u4. For completeness the text from DLA 680-1 available below with only corrected...
DLA-680-2 bash - version number correction
Bulletin has no description...
Firejail Remote Elevation of Privilege Vulnerability
Firejail is a suite of SUID programs written in C that reduces the risk of security vulnerabilities by restricting the runtime environment of untrusted applications using the Linux namespace and seccomp-bpf. A security vulnerability exists in Firejail that allows a remote attacker to exploit the...
[SECURITY] [DLA 680-1] bash security update
Package : bash Version : 4.2+dfsg-0.1+deb7u3 CVE ID : CVE-2016-7543 An old attack vector has been corrected in bash, a sh-compatible command language interpreter. CVE-2016-7543 Specially crafted SHELLOPTS+PS4 environment variables in combination with insecure setuid binaries can result in root...
DLA-680-1 bash - security update
Bulletin has no description...
UCloud-2 0 1 6 1 0-0 0 1: kernel‘Dirty Cow’to mention the right vulnerability Security Alert-vulnerability warning-the black bar safety net
The Linux kernel recently the outbreak of the’Dirty Cow’Vulnerability, CVE-2 0 1 6-5 1 9 5, can lead to a low-rights user to achieve the local extraction rights. Please check you are using the kernel is in the affected range, and timely upgrades. The scope of the impact Linux kernel =2.6.22...
Linux Kernel 2.6.22 3.9 (x86x64) - Dirty COW procselfmem Race Condition Privilege Escalation (SUID Method)
Linux Kernel 2.6.22 3.9 x86x64 - Dirty COW procselfmem Race Condition Privilege Escalation SUID Method / EDB-Note: After getting a shell, doing "echo 0 /proc/sys/vm/dirtywritebackcentisecs" may make the system more stable. uncomment correct payload first x86 or x64! $ gcc cowroot.c -o cowroot...
