Solaris 8 / 9 (/usr/ucb/ps) Local Information Leak Exploit

Exploit for solaris platform in category local exploits ========================================================== Solaris 8 / 9 /usr/ucb/ps Local Information Leak Exploit ========================================================== !/bin/sh $Id: raptorucbps,v 1.1 2006/07/26 12:15:42 raptor Exp $...

Solaris 8/9 - '/usr/ucb/ps' Local Information Leak

!/bin/sh $Id: raptorucbps,v 1.1 2006/07/26 12:15:42 raptor Exp $ raptorucbps - information leak with Solaris /usr/ucb/ps Copyright c 2006 Marco Ivaldi A security vulnerability in the "/usr/ucb/ps" see ps1B command may allow unprivileged local users the ability to see environment variables and the...

CVE-2006-3920

The TCP implementation in Sun Solaris 8, 9, and 10 before 20060726 allows remote attackers to cause a denial of service resource exhaustion via a TCP packet with an incorrect sequence number, which triggers an ACK storm...

Solaris 8/9 ps - Environment Variable Information leak

Solaris 8/9 ps - Environment Variable Information leak. CVE-1999-1587. Local exploit for Solaris platform !/bin/sh $Id: raptorucbps,v 1.1 2006/07/26 12:15:42 raptor Exp $ raptorucbps - information leak with Solaris /usr/ucb/ps Copyright c 2006 Marco Ivaldi A security vulnerability in the...

Design/Logic Flaw

Unspecified vulnerability in Solaris 8 and 9 allows local users to obtain the LDAP Directory Server root Distinguished Name rootDN password when a privileged user 1 runs idsconfig; or "insecurely" runs LDAP2 commands with the -w option, including 2 ldapadd, 3 ldapdelete, 4 ldapmodify, 5 ldapmodrd...

Solaris 8 (x86) : 109765-06

SunOS 5.8x86: /kernel/fs/hsfs patch. Date this patch was last updated by Sun : Feb/21/06 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

Code injection

Unspecified vulnerability in InfoVista PortalSE 2.0 Build 20087 on Solaris 8 without the IV00038969 hotfix allows remote attackers to read arbitrary files via a crafted URL...

Design/Logic Flaw

InfoVista PortalSE 2.0 Build 20087 on Solaris 8 allows remote attackers to obtain sensitive information by specifying a nonexistent server in the server field, which reveals the path in an error message...

CVE-2006-0862

Unspecified vulnerability in InfoVista PortalSE 2.0 Build 20087 on Solaris 8 without the IV00038969 hotfix allows remote attackers to read arbitrary files via a crafted URL...

CVE-2006-0863

InfoVista PortalSE 2.0 Build 20087 on Solaris 8 allows remote attackers to obtain sensitive information by specifying a nonexistent server in the server field, which reveals the path in an error message...

CVE-2006-0862

Unspecified vulnerability in InfoVista PortalSE 2.0 Build 20087 on Solaris 8 without the IV00038969 hotfix allows remote attackers to read arbitrary files via a crafted URL...

CVE-2006-0863

InfoVista PortalSE 2.0 Build 20087 on Solaris 8 is affected. The vulnerability allows remote disclosure of sensitive information by specifying a nonexistent server in the server field, causing the error message to reveal the path. Root cause: improper handling of non-existent server input leading...

CVE-2006-0862

CVE-2006-0862 affects InfoVista PortalSE 2.0 Build 20087 on Solaris 8; an unspecified vulnerability allows remote attackers to read arbitrary files via a crafted URL. The issue is reported to occur without the IV00038969 hotfix. No public details on underlying root cause are provided beyond the v...

Solaris 8 (sparc) : 117350-62

SunOS 5.8: kernel patch. Date this patch was last updated by Sun : Apr/21/09 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

CVE-2006-0227

Multiple unspecified vulnerabilities in lpsched in Sun Solaris 8, 9, and 10 allow local users to delete arbitrary files or disable the LP print service via unknown attack vectors...

Solaris dtspcd Heap Overflow

This is a port of noir's dtspcd exploit. This module should work against any vulnerable version of Solaris 8 sparc. The original exploit code was published in the book Shellcoder's Handbook. This module requires Metasploit: https://metasploit.com/download Current source:...

Sun rpc.cmsd Overflow

The remote Sun rpc.cmsd has integer overflow problem in xdrarray. An attacker may use this flaw to execute arbitrary code on this host with the privileges rpc.cmsd is running as typically, root, by sending a specially crafted request to this service. SPDX-FileCopyrightText: 2003 Xue Yong Zhi Some...

CVE-2005-3398

CVE-2005-3398 relates to the Solaris Management Console web server in Solaris 8/9/10 where the HTTP TRACE method is enabled by default. The effect is potential cross-site tracing information leakage (e.g., cookies or headers) through TRACE requests. Connected docs confirm the TRACE issue as a rec...

[SA16955] Sun Solaris Xsun and Xprt Privilege Escalation Vulnerability

TITLE: Sun Solaris Xsun and Xprt Privilege Escalation Vulnerability SECUNIA ADVISORY ID: SA16955 VERIFY ADVISORY: http://secunia.com/advisories/16955/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system OPERATING SYSTEM: Sun Solaris 9 http://secunia.com/product/95/ Sun Solari...

Solaris 8 (x86) : 118669-86

JavaSE 5.0x86: update 85 patch equivalent to JDK 5.0u85, 64bit. Date this patch was last updated by Sun : Apr/13/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...