Design/Logic Flaw

Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file...

CVE-2007-1027

Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file...

mysql improper suid argument evaluation

MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE...

ProFTPd 1.3.01.3.0a - mod_ctrls support Local Buffer Overflow (1)

ProFTPd 1.3.01.3.0a - modctrls support Local Buffer Overflow 1 !/usr/bin/perl -w $Id: revengeproftpdctrls24.pl, v1.0 2007/02/18 19:24:22 revenge Exp $ ProFTPD v1.3.0/1.3.0a Controls Buffer Overflow Exploit Old style school sploit against gcc 3.x and linux kernel 2.4 Original Advisory :...

bsd/x86 setuid/portbind shellcode 94 bytes

No description provided by source. / $Id: portbind-bsd.c,v 1.3 2004/06/02 12:22:30 raptor Exp $ portbind-bsd.c - setuid/portbind shellcode for BSD/x86 Copyright c 2003 Marco Ivaldi [email protected] Simple portbind shellcode that bind's a setuid0 shell on...

bsd/x86 setuid/execve shellcode 30 bytes

No description provided by source. / $Id: setuid-bsd.c,v 1.6 2004/06/02 12:22:30 raptor Exp $ setuid-bsd.c - setuid/execve shellcode for BSD/x86 Copyright c 2003 Marco Ivaldi [email protected] Short setuid0 and /bin/sh execve shellcode based on esdee's code. ...

Hacking tricks series of some common left the back door approach-vulnerability warning-the black bar safety net

For us such a dish hand, finally got the servers is not easy, if it is found it miserable. In fact, the open back door methods there are many, below I to talk, I've learned of several ways. 1. Setuid | cp /bin/sh /tmp/. root chmod u+s /tmp/. root --- Add suid bit to the shell on, although very...

MOAB-21-01-2007: System Preferences writeconfig Local Privilege Escalation Vulnerability

Summary Apple provides the following description in the The Preference Application documentation: System Preferences is the standard location for presenting system-level preferences on OSX. The preference panes shipped with Mac OS X include panes affecting hardware such as the Sound, Mouse, and...

MOAB-15-01-2007.rb.txt

!/usr/bin/ruby Exploit for MOAB-15-01-2007 c 2006 LMH . Note: It's a generic exploit, you can use it over any binary writable which is set as root setuid by diskutil repair permissions. Simply change the path. Blame Apple for doing such a piece of and relying on flawed DAC. Line-noise: Jackass of...

Design/Logic Flaw

IBM AIX 5.3 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572...

Design/Logic Flaw

HP HP-UX B11.11 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572...

Design/Logic Flaw

Sun Solaris 9 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572...

CVE-2007-0394

HP HP-UX B11.11 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572...

CVE-2007-0393

Sun Solaris 9 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572...

CVE-2007-0393

CVE-2007-0393 concerns Sun Solaris 9 where the system does not properly verify the status of file descriptors before setuid execution, enabling local privilege escalation by closing fd 0, 1, or 2 and then running a setuid program. The vulnerability is described as a variant of CVE-2002-0572. Conn...

CVE-2007-0392

CVE-2007-0392 affects IBM AIX 5.3. The issue is a failure to properly verify the status of file descriptors before setuid execution, enabling local privilege escalation by closing FD 0, 1, or 2 and then running a setuid program. Descriptions from connected sources identify this as a variant of CV...

CVE-2007-0394

Technical details about CVE-2007-0394 are not publicly available in the provided connected documents; the materials reiterate the HP-UX vulnerability without expanding on affected versions, impact specifics, or fixes. Monitor for updated advisories.

CVE-2007-0394: Undefined Security Weakness

HP HP-UX B11.11 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572...

CVE-2007-0392: Undefined Security Weakness

IBM AIX 5.3 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572...

CVE-2007-0393: Undefined Security Weakness

Sun Solaris 9 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572...