913 matches found
Protection bypass in linux
setgid call doesn't change saved gid...
Linux kernel setgid implementation flaw
Hi, I believe the following to be accurate and of some interest to bugtraq readers, although i did not have time to extensively test it, nor did i warn the vendor, since 1 this is at most a undirect risk - IMHO - and 2 i am going on holidays so i had to balance betweeen disclosing now and letting...
CVE-2002-0294
Alcatel 4400 installs the /chetc/shutdown command with setgid privileges, which allows many different local users to shut down the system...
CVE-2002-0294
The CVE-2002-0294 entry concerns Alcatel 4400. The affected component is the /chetc/shutdown command which is installed with setgid privileges. The underlying issue is privilege escalation by assigning setgid to a program used for system shutdown, enabling local users to shut down the system (imp...
CVE-2002-0294: Undefined Security Weakness
Alcatel 4400 installs the /chetc/shutdown command with setgid privileges, which allows many different local users to shut down the system...
CVE-1999-1142
SunOS 4.1.2 and earlier allows local users to gain privileges via LD_* environment variables affecting dynamically linked setuid/setgid programs (e.g., login, su, sendmail) by causing real and effective UIDs to the same user. This yields a local escalation with complete confidentiality and integr...
CVE-1999-1143
Vulnerability in runtime linker program rld in SGI IRIX 6.x and earlier allows local users to gain privileges via setuid and setgid programs...
CVE-1999-1143
Technical details for CVE-1999-1143 are not provided in the connected documents. The initial description summarizes a privilege escalation in SGI IRIX 6.x rld but no further public details are included here. Monitor for updates.
CVE-1999-1288: Undefined Security Weakness
Samba 1.9.18 inadvertently includes a prototype application, wsmbconf, which is installed with incorrect permissions including the setgid bit, which allows local users to read and write files and possibly gain privileges via bugs in the program...
CVE-1999-1143: Undefined Security Weakness
Vulnerability in runtime linker program rld in SGI IRIX 6.x and earlier allows local users to gain privileges via setuid and setgid programs...
Unixware Message catalog exploit code
Hi, I'm jGgM. I was reported this problem Caldera, a few week ago. And, This exploit is fixed already. Hacker can modify message catalog and, It can possible format string exploit. for example $ gcc -o expshell expshell.c $ gcc -o getret getret.c $ gcc -o fmtexp fmtexp.c $ ./expshell $ ./getret...
IMLib2 - Home Environment Variable Buffer Overflow
IMLib2 - Home Environment Variable Buffer Overflow // source: https://www.securityfocus.com/bid/3868/info Imlib2 is a freely available, open source graphics library available for the Linux and Unix operating systems. It is maintained by Michael Jennings. Imlib2 is installed on many operating...
CVE-1999-1428
Solaris Solstice AdminSuite AdminSuite 2.1 and 2.2 allows local users to gain privileges via the save option in the Database Manager, which is running with setgid bin privileges...
CVE-1999-1079
Vulnerability in ptrace in AIX 4.3 allows local users to gain privileges by attaching to a setgid program...
CVE-1999-1079: Undefined Security Weakness
Vulnerability in ptrace in AIX 4.3 allows local users to gain privileges by attaching to a setgid program...
CVE-1999-1428: Undefined Security Weakness
Solaris Solstice AdminSuite AdminSuite 2.1 and 2.2 allows local users to gain privileges via the save option in the Database Manager, which is running with setgid bin privileges...
Security Advisory FreeBSD-SA-01:55.procfs
-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:55 Security Advisory FreeBSD, Inc. Topic: procfs vulnerability leaks setugid process memory Category: core Module: procfs Announced: 2001-08-21 Credits: Joost Pol...
Solaris 8 libsldap - Local Buffer Overflow (2)
Solaris 8 libsldap - Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/2931/info Solaris 8 ships with a shared library that implements LDAP functionality called 'libsldap'. This library is linked to by a number of system utilities, many of them installed setuid or setgid...
Solaris 8 libsldap - Local Buffer Overflow (2)
// source: https://www.securityfocus.com/bid/2931/info Solaris 8 ships with a shared library that implements LDAP functionality called 'libsldap'. This library is linked to by a number of system utilities, many of them installed setuid or setgid. Libsldap contains a buffer overflow vulnerability ...