linux/x86-64 setuid(0) + execve(/bin/sh) 49 bytes

Exploit for linux/x86 platform in category shellcode ================================================= linux/x86-64 setuid0 + execve/bin/sh 49 bytes ================================================= / setuid0 + execve/bin/sh - just 4 fun. main asm "xorq %rdi,%rdi\n\t" "mov $0x69,%al\n\t" "syscall...

Linux Kernel 2.6.29 - ptrace_attach() Race Condition Privilege Escalation

Linux Kernel 2.6.29 - ptraceattach Race Condition Privilege Escalation / GNU/Linux kernel 2.6.29 ptraceattach local root race condition exploit. ========================================================================== This is a local root exploit for the 2.6.29 ptraceattach race condition that...

Linux Kernel 2.6.29 ptrace_attach() Local Root Race Condition Exploit

Exploit for linux platform in category local exploits ===================================================================== Linux Kernel 2.6.29 ptraceattach Local Root Race Condition Exploit ===================================================================== / GNU/Linux kernel 2.6.29 ptraceatta...

RHEL 5 : kernel (RHSA-2009:0473)

Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux...

kernel security update

CentOS Errata and Security Advisory CESA-2009:0473 Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages...

kernel: exit_notify: kill the wrong capable(CAP_KILL) check

The exitnotify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAPKILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exitsignal field and then uses an exec system...

CVE-2009-1527

Race condition in the ptraceattach function in kernel/ptrace.c in the Linux kernel before 2.6.30-rc4 allows local users to gain privileges via a PTRACEATTACH ptrace call during an exec system call that is launching a setuid application, related to locking an incorrect credexecmutex object...

CVE-2009-1527

Race condition in the ptraceattach function in kernel/ptrace.c in the Linux kernel before 2.6.30-rc4 allows local users to gain privileges via a PTRACEATTACH ptrace call during an exec system call that is launching a setuid application, related to locking an incorrect credexecmutex object...

kernel: exit_notify: kill the wrong capable(CAP_KILL) check

The exitnotify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAPKILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exitsignal field and then uses an exec system...

libvirt_proxy <= 0.5.1 Local Privilege Escalation Exploit

Exploit for linux platform in category local exploits ========================================================= libvirtproxy /tmp/getuid.c gcc -shared /tmp/getuid.c -o /tmp/getuid.so echo "+ setting up /tmp/run" echo -e "!/bin/sh" /tmp/run echo -e "touch /tmp/success" /tmp/run echo -e "echo...

Mandriva Linux Security Advisory : autofs (MDVSA-2008:009-1)

The default behaviour of autofs 5 for the hosts map did not specify the nosuid and nodev mount options. This could allow a local user with control of a remote NFS server to create a setuid root executable on the exported filesystem of the remote NFS server. If this filesystem was mounted with the...

Ubuntu 8.04 LTS / 8.10 : libpam-krb5 vulnerabilities (USN-719-1)

It was discovered that pamkrb5 parsed environment variables when run with setuid applications. A local attacker could exploit this flaw to bypass authentication checks and gain root privileges. CVE-2009-0360 Derek Chan discovered that pamkrb5 incorrectly handled refreshing existing credentials wh...

Mandriva Linux Security Advisory : kdelibs (MDVSA-2008:097)

A vulnerability was found in startkdeinit in KDE 3.5.5 through 3.5.9 where, if it was installed setuid root, it could allow local users to cause a denial of service or possibly execute arbitrary code CVE-2008-1671. By default, startkdeinit is not installed setuid root on Mandriva Linux, however...

CVE-2009-1337

The exitnotify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAPKILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exitsignal field and then uses an exec system...

Design/Logic Flaw

The exitnotify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAPKILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exitsignal field and then uses an exec system...

CVE-2009-1337

The exitnotify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAPKILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exitsignal field and then uses an exec system...

CVE-2009-1337

The exitnotify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAPKILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exitsignal field and then uses an exec system...

udev Netlink Message Validation Local Privilege Escalation Vulnerability

Description The 'udev' Linux application is prone to a local privilege-escalation vulnerability because it fails to properly handle netlink messages. Local attackers may exploit this issue to gain elevated privileges, which may lead to a complete compromise of the system. Versions prior to udev 1...

Mandriva Update for openafs MDKSA-2007:066 (openafs)

Check for the Version of openafs OpenVAS Vulnerability Test Mandriva Update for openafs MDKSA-2007:066 openafs Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Update for autofs MDVSA-2008:009-1 (autofs)

Check for the Version of autofs OpenVAS Vulnerability Test Mandriva Update for autofs MDVSA-2008:009-1 autofs Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...