3393 matches found
Adobe Version Cue 1.0/1.0.1 - Local Root Exploit (OSX)
No description provided by source. !/usr/bin/perl Adobe Version Cue VCNativeOSX: local root exploit. by: vade79/v9 [email protected] fakehalo/realhalo Adobe Version Cue's VCNative program writes data to a log file in the current working directory while running as setuid root. the logfile is formated...
QNX 6.4.x/6.5.x pppoectl - Information Disclosure
No description provided by source. QNX 6.4.x/6.5.x pppoectl disclose /etc/shadow by cenobyte 2013 [email protected] - vulnerability description: QNX setuid root /sbin/pppoectl allows any user to gain access to privileged information such as the root password hash. The vulnerability exis...
FreeBSD 2.2-4.2,NetBSD 1.2-4.5,OpenBSD 2.x ftpd glob() Buffer Overflow
No description provided by source. source: http://www.securityfocus.com/bid/2548/info The BSD ftp daemon and derivatives such as IRIX ftpd or the ftp daemon shipped with Kerberos 5 contain a number of buffer overflows that may lead to a compromise of root access to malicious users. During parsing...
Solaris 8 libsldap Buffer Overflow Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/2931/info Solaris 8 ships with a shared library that implements LDAP functionality called 'libsldap'. This library is linked to by a number of system utilities, many of them installed setuid or setgid. Libsldap contains a...
David Bagley xlock 4.16 User Supplied Format String Vulnerability (1)
No description provided by source. source: http://www.securityfocus.com/bid/1585/info A vulnerability exists in versions of the xlockmore program, originally written by David Bagley. It is believed to affect all versions of xlock derived from xlockmore. This includes the xlock shipped with a numb...
SCO Open Server 5.0.5 X Library Buffer Overflow Vulnerability (1)
No description provided by source. source: http://www.securityfocus.com/bid/638/info A buffer overflow vulnerability in the shared X library may allows local users to obtain higher privileges. Any setuid applications linked against the library are possibly vulnerable. The vulnerability is in the...
Mac OS X <= 10.2.4 DirectoryService (PATH) Local Root Exploit
No description provided by source. / OS X = 10.2.4 DirectoryService local root PATH exploit DirectoryService must be crashed prior to execution, per @stake advisory. If you discover how to crash DirectoryService e-mail me at [email protected] Neeko Oni -- Assuming DirectoryService has been...
Caldera UnixWare 7.1.1 Message Catalog Environment Variable Format String Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4060/info UnixWare is a commercially available Unix Operating System. It was originally developed by SCO, and is now distributed and maintained by Caldera. A format string vulnerability in the locale subsystem could lead ...
CDRTools CDRecord 1.11/2.0 Devname Format String Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7565/info CDRecord has been reported prone to a format string vulnerability. The issue presents itself due to a programming error that occurs when calling a printf-like function. It has been reported that by harnessing an...
SGI Performance Co-Pilot 2.1.x/2.2 pmpost Symbolic Link Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2887/info Performance Co-Pilot PCP is a set of services to support system-level performance monitoring developed by SGI. It has traditionally been an IRIX product, however SGI has made it open source and it is now availab...
Linux/ARM - setuid(0) & execve("/bin/sh","/bin/sh",0) - 38 bytes
No description provided by source. / Title: Linux/ARM - setuid0 & execve/bin/sh,/bin/sh,0 - 38 bytes Date: 2010-06-29 Tested: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan Web: http://shell-storm.org | http://twitter.com/jonathansalwan ! Dtabase of shellcodes http://www.shell-storm.org/shellcode/...
linux/x86 setuid(0) & execve(/bin/sh,0,0) shellcode 28 bytes
No description provided by source. -------------------ASM---------------------- global start section .text start: ;setuid0 xor ebx,ebx lea eax,ebx+17h cdq int 80h ;execve/bin/sh,0,0 xor ecx,ecx push ecx push 0x68732f6e push 0x69622f2f lea eax,ecx+0Bh mov ebx,esp int 80h...
Linux/ARM - setuid(0) & kill(-1, SIGKILL) - 28 bytes
No description provided by source. / Title: Linux/ARM - setuid0 & kill-1, SIGKILL - 28 bytes Kill all processes Date: 2010-06-29 Tested: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan Web: http://shell-storm.org | http://twitter.com/jonathansalwan ! Dtabase of shellcodes...
Oracle Database Server 9.0.x Oracle Binary Local Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8844/info Oracle Database Server 'oracle' binary has been reported prone to a local buffer overflow vulnerability. The issue likely presents itself due to a lack of sufficient boundary checks performed on command line...
BSDI BSD/OS <= 2.1,FreeBSD <= 2.1,IBM AIX <= 4.2,SGI IRIX <= 6.4,Sun SunOS <= 4.1.3
No description provided by source. source: http://www.securityfocus.com/bid/129/info Rdist is a program to maintain identical copies of files over multiple hosts. It preserves the owner, group, mode, and mtime of files if possible and can update programs that are executing. Rdist reads commands...
QNX 6.x 'ptrace()' Arbitrary Process Modification Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4919/info The QNX implementation of 'ptrace' is reportedly insecure. An unprivileged process may attach to a setuid program without restriction. Since the attaching process may view or edit memory, an attacker may exploit...
Ifenslave 0.0.7 Argument Local Buffer Overflow Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/7682/info ifenslave for Linux has been reported prone to a buffer overflow vulnerability. The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it is copied into an...
Linux/x86 Polymorphic ShellCode - setuid(0)+setgid(0)+add user 'iph' without password to /etc/passwd
No description provided by source. / Exploit Title: Linux/x86 Polymorphic ShellCode - setuid0+setgid0+add user 'iph' without password to /etc/passwd setuid - setgid - open - write - close - exit Date: 30/12/2011 Author: pentesters.ir Tested on: Linux x86 - CentOS 6.0 - 2.6.32-71 Website:...
David Bagley xlock 4.16 User Supplied Format String Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/1585/info A vulnerability exists in versions of the xlockmore program, originally written by David Bagley. It is believed to affect all versions of xlock derived from xlockmore. This includes the xlock shipped with a numb...
Solaris 7/8 kcms_configure Command-Line Buffer Overflow Vulnerability (1)
No description provided by source. source: http://www.securityfocus.com/bid/2558/info The Kodak Color Management System, or KCMS, is a package that ships with workstation installations of Solaris 7 and 8. kcmsconfigure, a part of KCMS, is vulnerable to a buffer overflow if it is passed an overly...