List Files with setuid-bit in / and /home, Check /tmp for sticky-bit

This plugin uses SSH to list files with setuid-bit in / and /home, check /tmp for sticky-bit. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

linux/x86 setuid(0) ^ execve("/bin/sh", 0, 0) shellcode 27 bytes

Exploit for linux/x86 platform in category shellcode ================================================================ linux/x86 setuid0 ^ execve"/bin/sh", 0, 0 shellcode 27 bytes ================================================================...

linux/x86 setuid(0) + execve("/bin/sh",...) Shellcode 29 bytes

Exploit for linux/x86 platform in category shellcode ============================================================== linux/x86 setuid0 + execve"/bin/sh",... Shellcode 29 bytes ============================================================== / 29 byte-long setuid0 + execve"/bin/sh",... shellcode by...

Mandriva Update for nss_db MDVSA-2010:077 (nss_db)

Check for the Version of nssdb OpenVAS Vulnerability Test Mandriva Update for nssdb MDVSA-2010:077 nssdb Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Linux Kernel <= 2.6.34-rc3 ReiserFS xattr Privilege Escalation

No description provided by source. !/usr/bin/env python ''' team-edward.py Linux Kernel = 2.6.34-rc3 ReiserFS xattr Privilege Escalation Jon Oberheide [email protected] http://jon.oberheide.org Information: https://bugzilla.redhat.com/showbug.cgi?id=568041 The kernel allows processes to access th...

Linux Kernel 2.6.34-rc3 ReiserFS xattr Privilege Escalation

!/usr/bin/env python ''' team-edward.py Linux Kernel http://jon.oberheide.org Information: https://bugzilla.redhat.com/showbug.cgi?id=568041 The kernel allows processes to access the internal ".reiserfspriv" directory at the top of a reiserfs filesystem which is used to store xattrs. Permissions...

ReiserFS (Linux Kernel 2.6.34-rc3 RedHat Ubuntu 9.10) - xattr Local Privilege Escalation

ReiserFS Linux Kernel 2.6.34-rc3 RedHat Ubuntu 9.10 - xattr Local Privilege Escalation !/usr/bin/env python ''' team-edward.py Linux Kernel http://jon.oberheide.org Information: https://bugzilla.redhat.com/showbug.cgi?id=568041 The kernel allows processes to access the internal ".reiserfspriv"...

ReiserFS (Linux Kernel 2.6.34-rc3 / RedHat / Ubuntu 9.10) - 'xattr' Local Privilege Escalation

!/usr/bin/env python ''' team-edward.py Linux Kernel http://jon.oberheide.org Information: https://bugzilla.redhat.com/showbug.cgi?id=568041 The kernel allows processes to access the internal ".reiserfspriv" directory at the top of a reiserfs filesystem which is used to store xattrs. Permissions...

CVE-2010-0826

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

DEBIAN-CVE-2010-0826

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

Design/Logic Flaw

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

CVE-2010-0826

The CVE-2010-0826 issue affects the Free Software Foundation’s Berkeley DB NSS module (libnss-db) in the nss_db package (2.2.3pre1). The vulnerability arises because DB_CONFIG can be read from the current working directory, enabling a local attacker with setgid/setuid usage of the module to exfil...

CVE-2010-0826

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

CVE-2010-0826

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

openSUSE Security Update : cifs-mount (cifs-mount-2128)

With enabled 'wide links' samba follows symbolic links on the server side, therefore allowing clients to overwrite arbitrary files CVE-2010-0926. This update changes the default setting to have 'wide links' disabled by default. The new default only works if 'wide links' is not set explicitly in...

openSUSE Security Update : cifs-mount (cifs-mount-2128)

With enabled 'wide links' samba follows symbolic links on the server side, therefore allowing clients to overwrite arbitrary files CVE-2010-0926. This update changes the default setting to have 'wide links' disabled by default. The new default only works if 'wide links' is not set explicitly in...

SuSE 11 Security Update : Samba (SAT Patch Number 2126)

With enabled 'wide links' Samba follows symbolic links on the server side, therefore allowing clients to overwrite arbitrary files CVE-2010-0926. This update changes the default setting to have 'wide links' disabled by default. The new default only works if 'wide links' is not set explicitly in...

DSA-2007-1 cups - arbitrary code execution

Bulletin has no description...

kernel: personality: fix PER_CLEAR_ON_SETID

The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PERCLEARONSETID setting that does not clear the ADDRCOMPATLAYOUT and MMAPPAGEZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to 1 conduct NULL...

solaris/x86 setuid(0) execve(//bin/sh)

No description provided by source. / ; sm4x 2008 ; setuid0, execve'/bin/sh', '/bin/sh', 0, ; 39 bytes NizzULL free you know... ; SunOS sol01 5.11 snv86 i86pc i386 i86pc Solaris ; quick port to drop root sh - ; - SunOS is pwnij global start start: xor eax, eax ; --- setuid0 push eax push eax mov a...