format string vulnerability in mars_nwe 0.99pl19

Hello, Marsnwe 0.99.pl19 is vulnerable to remote format string vulnerability, allowing to gain superuser privileges from DOS/Windows workstations attached to mars server. Here is the patch: --- tools.c.orig Fri Jan 26 22:46:34 2001 +++ tools.c Fri Jan 26 22:46:59 2001 @@ -189,7 +189,7 @@...

ISC BIND 4 contains buffer overflow in nslookupComplain()

Overview The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS by the Internet Software Consortium ISC. There is a buffer overflow vulnerability in BIND 4.9.x, which may allow remote intruders to gain access to systems running BIND. Although BIND 4.9.x is no...

ISC BIND 4 contains input validation error in nslookupComplain()

Overview The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS by the Internet Software Consortium ISC. There is a format string vulnerability in BIND 4.9.4 that may allow remote intruders to gain access to systems running BIND. Although BIND 4.9.x is no longer...

FreeBSD-SA-00:77.procfs

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:77 Security Advisory FreeBSD, Inc. Topic: Several vulnerabilities in procfs REVISED Category: core Module: procfs Announced: 2000-12-18 Reissued: 2000-12-29 Affects:...

Security Advisory: FreeBSD-SA-00:77.procfs

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:77 Security Advisory FreeBSD, Inc. Topic: Several vulnerabilities in procfs Category: core Module: procfs Announced: 2000-12-18 Affects: Problem 1: FreeBSD 4.x prior to t...

Format string vulnerability in libutil pw_error(3) function

Overview There is an input validation vulnerability in the OpenBSD libutil system library that allows local users to gain superuser access via the chpass utility. Description On June 30, 2000, the OpenBSD development team repaired an input validation vulnerability in the pwerror function of the...

ISS Security Advisory: Insecure call of external programs in Red Hat Linux tmpwatch

-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security Advisory October 6, 2000 Insecure call of external programs in Red Hat Linux tmpwatch Synopsis: The tmpwatch utility is used in Red Hat Linux to remove temporary files. This utility has an option to call the "fuser" program,...

RedHat 6.2/7.0 Tmpwatch - Arbitrary Command Execution

// source: https://www.securityfocus.com/bid/1785/info A vulnerability exists in tmpwatch, a utility which automates the removal of temporary files in unix-like systems. An optional component of tmpwatch, fuser, improperly handles arguments to system library calls. If an attacker creates a file...

mysql.grant.txt

Hi. While installing MySQL 3.22.29 and testing it out, I discovered a very serious bug in it's handling of the GRANT statement. I have decided to post this message at this time although a fixed distribution is not yet available at mysql.com. The reason for this is that the subject has been...

unixware.Xsco.txt

-----Original Message----- Date: Fri, 26 Nov 1999 04:27:16 +0300 MSK From: Matt Conover To: [email protected] Subject: w00giving '99 6: UnixWare 7's Xsco Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII w00w00 Security Development WSD...

PT-1999-1035 · Linux · Linux

Name of the Vulnerable Software and Affected Versions: Linux affected versions not specified Description: A buffer overflow issue in the Linux su command allows local users to gain root access. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

pam_unix_passwd.so.txt

Date: Wed, 23 Dec 1998 13:12:45 +0100 From: Michal Zalewski Reply-To: Bugtraq List To: [email protected] Subject: Linux PAM up to 0.64-2 local root compromise As someone said, "Never make any mistaeks." Latest release of Linux Pluggable Authentication Modules pam-0.64-2, as well as previous...

digital.unix.dtlogin.txt

Date: Fri, 11 Jun 1999 11:11:10 -0700 PDT From: CIAC Mail User To: [email protected] Subject: CIAC Bulletin J-044: Tru64/Digital UNIX dtlogin Security Vulnerability For Public Release -----BEGIN PGP SIGNED MESSAGE----- The U.S. Department of Energy Computer Incident Advisory Capabili...

ipop3d.4.xx.bof.txt

Date: Sun, 7 Mar 1999 01:41:25 +0100 From: Michal Zalewski Overflow in CAC.Washington.EDU ipop3d 4.xx CAC.Washington.EDU ipop3d 4.xx, at least on Linux platform, has serious security hole. When data is read from so-called mailbox lock created in /tmp directory this happens under certain condition...

redhat.su.ghost.bug.txt

Date: Wed, 16 Jun 1999 13:47:52 +0200 From: Roman Ramirez Reply-To: [email protected] Organization: Intercomputer, S.A. To: [email protected] Hello: I think I have found some kind of bug in "su" in Redhat linux versions tested on Redhat 5.2 y Redhat 6.0 The problem seems to be when you...

SCO Open Server 5.0.5 - XBase Buffer Overflow

SCO Open Server 5.0.5 - XBase Buffer Overflow // source: https://www.securityfocus.com/bid/479/info The XBase package that ships with SCO OpenServer 5.0. is vulnerable to several buffer overflow attacks in many different XBase tools. The tools that are installed setuid root allow local users to...

SCO Open Server 5.0.5 - XBase Buffer Overflow

// source: https://www.securityfocus.com/bid/479/info The XBase package that ships with SCO OpenServer 5.0. is vulnerable to several buffer overflow attacks in many different XBase tools. The tools that are installed setuid root allow local users to gain superuser privileges. This is because they...

Solaris 2.5.1 - 'kcms' Local Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/452/info There is an unchecked sprintf call in the versions of /usr/openwin/bin/kcmsconfigure shipped with solaris 2.5, 2.5.1 and 2.6. Unfortunately, kcmsconfigure is installed setuid root, making it possible for an attacker to overflow the buffer and...

Solaris 2.5.1 - 'kcms' Local Buffer Overflow (2)

/ source: https://www.securityfocus.com/bid/452/info There is an unchecked sprintf call in the versions of /usr/openwin/bin/kcmsconfigure shipped with solaris 2.5, 2.5.1 and 2.6. Unfortunately, kcmsconfigure is installed setuid root, making it possible for an attacker to overflow the buffer and...

Xi Graphics Maximum CDE 1.2.3TriTeal TED CDE 4.3Sun Solaris 2.5.1 - ToolTalk RPC Service Overflow (1)

Xi Graphics Maximum CDE 1.2.3TriTeal TED CDE 4.3Sun Solaris 2.5.1 - ToolTalk RPC Service Overflow 1 // source: https://www.securityfocus.com/bid/122/info An implementation fault in the ToolTalk object database server allows a remote attacker to run arbitrary code as the superuser on hosts...