Integer overflow

Integer overflow in the aiosuspend function in Sun Solaris 8 through 10 and OpenSolaris, when 32-bit mode is enabled, allows local users to cause a denial of service panic via a large integer value in the second argument aka nent argument...

CVE-2009-0132

Integer overflow in the aiosuspend function in Sun Solaris 8 through 10 and OpenSolaris, when 32-bit mode is enabled, allows local users to cause a denial of service panic via a large integer value in the second argument aka nent argument...

CVE-2009-0132

CVE-2009-0132 describes an integer overflow in the aio_suspend function in Sun Solaris 8–10 and OpenSolaris when 32‑bit mode is enabled, enabling local denial of service (panic). The issue affects Solaris 9/10 variants (sparc/x86) and OpenSolaris. Concrete details from connected documents show pa...

Sun Solaris 'lpadmin'和'ppdmgr'本地拒绝服务漏洞

BUGTRAQ ID: 33269 Sun Solaris是一款商业性质的操作系统。 Sun Solaris包含的lpadmin1M和ppdmgr1M存在安全，在特定情况下，允许本地攻击者使系统部分服务或者整个系统触发panic，造成拒绝服务攻击。 目前没有详细漏洞细节提供。 Sun Solaris 10.0x86 Sun Solaris 10.0 Sun OpenSolaris build snv96 Sun OpenSolaris build snv95 Sun OpenSolaris build snv92 Sun OpenSolaris build snv91 Sun...

Sun Java System Access Manager 'sub-realm'特权提升漏洞

BUGTRAQ ID: 33266 CNCAN ID：CNCAN-2009011503 Sun Java System Access Manager是一款安全单点登录、认证、授权解决方案。 Sun Java System Access Manager存在安全漏洞，允许sub-real管理员提升特权或访问root realm作为管理员。 目前没有详细漏洞细节提供。 Sun Java System Access Manager 7.1 Windows Sun Java System Access Manager 7.1 Solaris x86 Sun Java System Access...

[security bulletin] HPSBMA02392 SSRT071481 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01607558 Version: 1 HPSBMA02392 SSRT071481 rev.1 - HP OpenView Network Node Manager OV NNM, Remote Denial of Service DoS NOTICE: The information in this Security Bulletin should be acted upon as...

Solaris integer overflow

Integer overflow in SYSkaio syscall...

[TKADV2009-001] Sun Solaris aio_suspend() Kernel Integer Overflow Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: Sun Solaris aiosuspend Kernel Integer Overflow Vulnerability Advisory ID: TKADV2009-001 Revision: 1.0 Release Date: 2009/01/08 Last Modified: 2009/01/08 Date Reported: 2008/09/15 Author: Tobias Klein tk at trapkit.de Affected Software: Solar...

Sun Solaris rpc.metad远程拒绝服务漏洞

BUGTRAQ ID: 28261 CVECAN ID: CVE-2008-1480 Solaris是一款由Sun开发和维护的商业性质UNIX操作系统。 如果远程攻击者向Solaris提交了恶意RPC请求的话，就会导致rpc.metad1M崩溃，服务和Solaris卷标管理器（SVM）命令会失效，这是一种拒绝服务。 Sun Solaris 9.0x86 Sun Solaris 9.0 Sun Solaris 10.0x86 Sun Solaris 10.0 Sun OpenSolaris snv01 - snv95 Sun Solstice Disk Suite 4.2.1 厂商补丁：...

Sun Solaris 'aio_suspend()'整数溢出本地拒绝服务漏洞

BUGTRAQ ID: 33188 CNCAN ID：CNCAN-2009011201 Sun Solaris是一款商业性质的服务器。 Sun Solaris 'aiosuspend'存在整数溢出错误，本地攻击者可以利用漏洞对系统进行拒绝服务攻击。 问题存在于如下代码中： /uts/common/os/aio.c .. 221 static int64t 222 kaioc 223 long a0, 224 long a1, 225 long a2, 226 long a3, 227 long a4, 228 long a5 229 230 int error; 231 long rva...

Code injection

Unspecified vulnerability in the nfs4renamepersistentfh function in the NFS 4 aka NFSv4 client in the kernel in Sun Solaris 10 and OpenSolaris before snv102 allows local users to cause a denial of service recursive mutexenter and panic via unspecified vectors...

CVE-2009-0069

Unspecified vulnerability in the nfs4renamepersistentfh function in the NFS 4 aka NFSv4 client in the kernel in Sun Solaris 10 and OpenSolaris before snv102 allows local users to cause a denial of service recursive mutexenter and panic via unspecified vectors...

CVE-2009-0069

Unspecified vulnerability in the nfs4renamepersistentfh function in the NFS 4 aka NFSv4 client in the kernel in Sun Solaris 10 and OpenSolaris before snv102 allows local users to cause a denial of service recursive mutexenter and panic via unspecified vectors...

CVE-2009-0069

CVE-2009-0069 affects the NFSv4 client in Sun Solaris 10 and OpenSolaris (pre-snV_102) where the kernel’s nfs4rename_persistent_fh function can be abused by local users to trigger a denial of service (recursive mutex_enter and panic). The issue is fixed by Sun patch 139466-04 (SPARC) and 139467-0...

Solaris/SPARC - Bind TCP Shell Shellcode

Solaris/SPARC - Bind TCP Shell Shellcode. Shellcode exploit for SolarisSPARC platform. Tags: Metasploit Framework MSF Name: singlebindtcp Platforms: Solaris Authors: vlad902 Version: $Revision: 1.2 $ License: This file is part of the Metasploit Exploit Framework and is subject to the same license...

Solaris/SPARC - Bind TCP (2001/TCP) Shell (/bin/sh) Shellcode

Solaris/SPARC - Bind TCP 2001/TCP Shell /bin/sh Shellcode. Shellcode exploit for SolarisSPARC platform !!! $Id: sparc-bind.s,v 1.1 2003/03/01 01:10:51 ghandi Exp $ !!! Bind /bin/sh to TCP port 2001. Calls setuid0 so /bin/sh won't !!! drop privileges. After assembly, change the third byte in the !...

Solaris/SPARC - setreuid(geteuid()) + setregid(getegid()) + execve(/bin/sh) Shellcode

Solaris/SPARC - setreuidgeteuid + setregidgetegid + execve/bin/sh Shellcode. Shellcode exploit for SolarisSPARC platform / Solaris shellcode - setreuidgeteuid, setregidgetegid, execve /bin/sh Claes M. Nyberg 20020124 , / include static char solariscode = / geteuid / "\x82\x10\x20\x18" / mov 24, %...

Solaris/x86 - setuid(0) + /bin/cat /etc/shadow Shellcode (61 bytes)

Solaris/x86 - setuid0 + /bin/cat /etc/shadow Shellcode 61 bytes. Shellcode exploit for Solarisx86 platform. Tags: Metasploit Framework MSF Name = John Babio Twitter = 3vi1john SunOS opensolaris 10 5.11 i86pc i386 i86pc setuid0 /bin/cat //etc/shadow char code=...

Solaris/x86 - execve(/bin/sh) Shellcode (43 bytes)

Solaris/x86 - execve/bin/sh Shellcode 43 bytes. Shellcode exploit for Solarisx86 platform / Solaris shellcode - execve /bin/sh / include // http://www.shellcode.com.ar // // execve//bin/sh char shellcode= "\xb8\xff\xf8\xff\x3c" // mov eax, 03cfff8ffh "\xf7\xd0" // not eax "\x50" // push eax...

CVE-2008-5699

The name service cache daemon nscd in Sun Solaris 10 and OpenSolaris snv50 through snv104 does not properly check permissions, which allows local users to gain privileges and obtain sensitive information via unspecified vectors...