SGI IRIX 6.2 - midikeyssoundplayer Local Privilege Escalation

SGI IRIX 6.2 - midikeyssoundplayer Local Privilege Escalation !/bin/sh source: https://www.securityfocus.com/bid/909/info SGI's Irix operating system ships with an X11 application called 'soundplayer' which is used to play .WAV files. It is not setuid root by itself, but can inherit root privileg...

Majordomo 1.94.4/1.94.5 - Local -C Parameter (1)

source: https://www.securityfocus.com/bid/903/info It is possible for a local user to gain majordomo privileges through a vulnerability which allows privileged arbitrary commands to be executed. If the -C parameter is passed to majordomo or one of several other scripts when run with the setuid ro...

Great Circle Associates Majordomo 1.94.4 - Local resend

Great Circle Associates Majordomo 1.94.4 - Local resend source: https://www.securityfocus.com/bid/902/info It is possible to execute arbitrary commands with elevated privileges through exploiting the majordomo binary, "resend". A setuid root wrapper program calls resend after setuiding and...

Great Circle Associates Majordomo 1.94.4 - Local resend

source: https://www.securityfocus.com/bid/902/info It is possible to execute arbitrary commands with elevated privileges through exploiting the majordomo binary, "resend". A setuid root wrapper program calls resend after setuiding and setgiding to lowered but still elevated privileges which it ru...

SunOS 4.1.1 - usrreleasebinmakeinstall Local Privilege Escalation

SunOS 4.1.1 - usrreleasebinmakeinstall Local Privilege Escalation source: https://www.securityfocus.com/bid/21/info This applies to sites that have installed Sun Source tapes only. The Sun distribution of sources sunsrc has an installation procedure which creates the directory /usr/release/bin an...

SunOS 4.1.1 - '/usr/release/bin/makeinstall' Local Privilege Escalation

source: https://www.securityfocus.com/bid/21/info This applies to sites that have installed Sun Source tapes only. The Sun distribution of sources sunsrc has an installation procedure which creates the directory /usr/release/bin and installs two setuid root files in it: makeinstall and winstall...

SunOS 4.1.1 - usrreleasebinwinstall Local Privilege Escalation

SunOS 4.1.1 - usrreleasebinwinstall Local Privilege Escalation source: https://www.securityfocus.com/bid/22/info This applies to sites that have installed Sun Source tapes only. The Sun distribution of sources sunsrc has an installation procedure which creates the directory /usr/release/bin and...

SunOS 4.1.1 - '/usr/release/bin/winstall' Local Privilege Escalation

source: https://www.securityfocus.com/bid/22/info This applies to sites that have installed Sun Source tapes only. The Sun distribution of sources sunsrc has an installation procedure which creates the directory /usr/release/bin and installs two setuid root files in it: makeinstall and winstall...

oracle_intelligent_agent.txt

START OF BUGTRAQ POST Oracle installations with the 'Oracle Intelligent Agent' installed have a path related vulnerability. The problem lies in the dbsnmp program located in $ORACLEHOME/bin . This setuid root program calls a tcl script nmiconf.tcl located by default in...

Mandriva Linux Mandrake 6.0 Gnome Libs 1.0.8 - espeaker Local Buffer Overflow

Mandriva Linux Mandrake 6.0 Gnome Libs 1.0.8 - espeaker Local Buffer Overflow source: https://www.securityfocus.com/bid/663/info A buffer overflow vulnerabilityin GNOME's shared libraries handling of the 'espeaker' command line argument may allow local users to attack setuid binaries linked again...

Mandriva Linux Mandrake 6.0 / Gnome Libs 1.0.8 - 'espeaker' Local Buffer Overflow

source: https://www.securityfocus.com/bid/663/info A buffer overflow vulnerabilityin GNOME's shared libraries handling of the 'espeaker' command line argument may allow local users to attack setuid binaries linked against these libraries to obtain root access. Calling a program linked against GNO...

dtsession_vuln.txt

Subject: Vulnerability in dtsession To: [email protected] Hello, I discovered the following security problem in dtsession actually in libtt.so, part of CDE: Description ----------- The session manager dtsession contains an overflow vulnerability when parsing the environment variable...

SCO Open Server 5.0.5 - X Library Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/638/info A buffer overflow vulnerability in the shared X library may allows local users to obtain higher privileges. Any setuid applications linked against the library are possibly vulnerable. The vulnerability is in the handling of the '-bg' command...

SCO Open Server 5.0.5 - X Library Buffer Overflow (1)

SCO Open Server 5.0.5 - X Library Buffer Overflow 1 // source: https://www.securityfocus.com/bid/638/info A buffer overflow vulnerability in the shared X library may allows local users to obtain higher privileges. Any setuid applications linked against the library are possibly vulnerable. The...

Martin Stover Mars NWE 0.99 - Local Buffer Overflow

Martin Stover Mars NWE 0.99 - Local Buffer Overflow // source: https://www.securityfocus.com/bid/617/info There are several buffer overflows in the setuid root components of the Mars Netware Emulator package. They allow for a local root compromise through the overflowing of buffers without bounds...

RedHat Linux 4.2/5.2/6.0 / S.u.S.E Linux 6.0/6.1 - Cron Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/602/info The version of Vixie cron that ships with RedHat versions 4.2, 5.2 and 6.0 is vulnerable to a local buffer overflow attack. By utilizing the MAILTO environment variable, a buffer can be overflown in the cronpopen function, allowing an attacker...

RedHat Linux 6.0 Slackware Linux 4.0 - Termcap tgetent() Local Buffer Overflow (2)

RedHat Linux 6.0 Slackware Linux 4.0 - Termcap tgetent Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/588/info A buffer overflow existed in libtermcap's tgetent function, which could cause the user to execute arbitrary code if they were able to supply their own termcap file...

clearcase2.txt

Date: Tue, 9 Feb 1999 17:57:27 +0100 From: Oezguer Kesim To: [email protected] Subject: Re: L0pht Advisory - Rational Software ClearCase root exploitable race conditions Holla, things are even worse! You may want to remove the setuid flag from /usr/atria/etc/dbloader, but this won't fix the...

xtvscreen.suse6.txt

Date: Thu, 18 Feb 1999 15:54:24 +0000 From: Andre Cruz To: [email protected] Subject: xtvscreen and suse 6 You can use xtvscreen to overwrite any file on the system. Xtvscreen has a function to capture a snapshot and will write it as pic000.pnm, pic001.pnm, etc in it's working directory. It...

mother2.sh

!/bin/sh mother2.sh by; syg @ EFnet AKA the bitch who doesnt care to take credit for such a worthless script that doesnt do anything hard, I just wanted to say those other two bitches are dumb as fuck for even sending this to the public and actually making a huge prop header as if it was some sor...