Solaris ypupdated Command Execution

No description provided by source. $Id: ypupdatedexec.rb 9929 2010-07-25 21:37:54Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of us...

Check Point Software Firewall-1 3.0/1 4.0 Table Saturation Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/549/info A denial of service condition exists in some implementations of Firewall-1 by Checkpoint Software. This denial of service attack is possible due to the way Firewall-1 handles TCP connections. Typically to initiat...

Solaris 2.x/7.0/8 lpd Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3274/info The print protocol daemon, 'in.lpd' or 'lpd', shipped with Solaris may allow for remote attackers to execute arbitrary commands on target hosts with superuser privileges. The alleged vulnerability is not the...

Solaris 7/8 kcms_configure Command-Line Buffer Overflow Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/2558/info The Kodak Color Management System, or KCMS, is a package that ships with workstation installations of Solaris 7 and 8. kcmsconfigure, a part of KCMS, is vulnerable to a buffer overflow if it is passed an overly...

Ghostscript < 8.64 'gdevpdtb.c' Buffer Overflow Vulnerability

No description provided by source. Ghostscript is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it into a finite-sized buffer. Exploiting this issue allows remote attackers to overwrite a sensitive memory buffer with...

solaris/x86 setuid(0), execve(//bin/sh); exit(0) NULL Free 39 bytes

No description provided by source. / ; sm4x 2008 ; setuid0, execve'/bin/sh', '/bin/sh', 0, ; 39 bytes NizzULL free you know... ; SunOS sol01 5.11 snv86 i86pc i386 i86pc Solaris ; quick port to drop root sh - ; - SunOS is pwnij global start start: xor eax, eax ; --- setuid0 push eax push eax mov a...

Solaris 10 (libnspr) - Arbitrary File Creation Local Root Exploit

No description provided by source. !/bin/sh $Id: raptorlibnspr,v 1.1 2006/10/13 19:12:12 raptor Exp $ raptorlibnspr - Solaris 10 libnspr oldschool local root Copyright c 2006 Marco Ivaldi [email protected] Local exploitation of a design error vulnerability in version 4.6.1 of NSPR, as includ...

IBM AIX <= 4.2.1, Sun Solaris <= 7.0 LC_MESSAGES libc Buffer Overflow Vulnerability (4)

No description provided by source. source: http://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LCMESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM...

Solaris 9 / 10 - ld.so Local Root Exploit (2)

/ Solaris 9 on SPARC: $ cat dupa.c / char sh = / setuid / \x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08 / execve / \x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff\x90\x03\xe0\x20 \x92\x02\x20\x10\xc0\x22\x20\x08\xd0\x22\x20\x10\xc0\x22\x20\x14 \x82\x10\x20\x0b\x91\xd0\x20\x08/bin/ksh; int...

Solaris/x86 - Remote Download file - 79 bytes

No description provided by source. / Title: Solaris/x86 - Remote Download file - 79 bytes Author: Jonathan Salwan submit ! shell-storm.org Web: http://www.shell-storm.org Twitter: http://twitter.com/jonathansalwan !Database of Shellcodes http://www.shell-storm.org/shellcode/ Date: 2010-05-25...

SunOS 5.7 Catman - Local Insecure tmp Symlink Clobber Exploit

No description provided by source. !/usr/local/bin/perl -w The problem is catman creates files in /tmp insecurly. They are based on the PID of the catman process, catman will happily clobber any files that are symlinked to that file. The idea of this script is to watch the process list for the...

Solaris <= 2.6 Profiling File Creation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/659/info A vulnerability in the dynamic linkers while profiling a shared object allows local users to create arbitrary files in the system. It canno't be used to overwrite existing files. If the LDPROFILE environment...

Sun Solaris <= 2.5.1 PAM & unix_scheme Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/201/info There is a buffer overflow condition on arguments in Pluggable Authentication Modules PAM and unixscheme 5.4 and 5.3. Therefore, an unauthorized user could exploit this vulnerability via the passwd program to gai...

Sun Solaris 8/9 Unspecified Passwd Local Root Compromise Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9757/info Sun has reported an unspecified vulnerability in the passwd utility on Solaris that may permit local attackers to gain unauthorized root privileges. / $Id: raptorpasswd.c,v 1.1 2004/12/04 14:44:38 raptor Exp $...

Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/20471/info The Netscape Portable Runtime API running on Sun Solaris 10 operating system is prone to a local privilege-escalation vulnerability. A successful exploit of this issue allows an attacker to gain superuser...

Solaris 2/7/8/9 cachefsd Heap Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4674/info A remotely exploitable buffer overflow condition has been reported in cachefsd. The overflow occurs in the heap and is reportedly exploitable as valid malloc chunk structures are overwritten. Successful attacks...

Solaris/Open Solaris UCODE_GET_VERSION IOCTL - Denial of Service

No description provided by source. / cve-2010-0453.c -- Patroklos Argyroudis, argp at domain census-labs.com Denial of service kernel panic PoC exploit for the UCODEGETVERSION ioctl NULL pointer dereference vulnerability on Solaris/OpenSolaris: http://www.trapkit.de/advisories/TKADV2010-001.txt...

Sun AnswerBook2 1.4.2/1.4.3/1.4.4 Administration Interface Access

No description provided by source. source: http://www.securityfocus.com/bid/1554/info A lack of authentication checks for certain scripts within the administration interface of AnswerBook2 versions 1.4.2 and prior, for Solaris, allows remote users to create administration accounts. By directly...

Solaris 2.6/7.0 "eject" exploit for locale subsystem format string

No description provided by source. / source: http://www.securityfocus.com/bid/1634/info nectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems provide...

Solaris sadmind adm_build_path - Buffer Overflow

No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...