FreeBSD 'pseudofs' NULL Pointer Dereference Local Privilege Escalation Vulnerability

No description provided by source. / Source: http://www.securityfocus.com/bid/43060/info 18.08.2010, babcia padlina FreeBSD 7.0 - 7.2 pseudofs null ptr dereference exploit to obtain SYSENT8SYCALLADDR, run: $ kgdb /boot/kernel/kernel kgdb print &sysent8.sycall / define SYSENT8SYCALLADDR 0xc0c4afa4...

CVE-2010-3301

The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x8664 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-boun...

Out-of-bounds

The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x8664 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-boun...

CVE-2010-3301

The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x8664 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-boun...

CVE-2010-3067

Integer overflow in the doiosubmit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the iosubmit system call...

Integer overflow

Integer overflow in the doiosubmit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the iosubmit system call...

CVE-2010-3067

Integer overflow in the doiosubmit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the iosubmit system call...

Linux Kernel 2.6.27 < 2.6.36 (RedHat x86-64) - 'compat' Local Privilege Escalation

/ Ac1dB1tch3z Vs Linux Kernel x8664 0day Today is a sad day.. R.I.P. Tue, 29 Apr 2008 / Tue, 7 Sep 2010 a bit of history: MCASTMSFILTER Compat mode bug found... upon commit! 2 year life on this one author David L Stevens Tue, 29 Apr 2008 10:23:22 +0000 03:23 -0700 committer David S. Miller Tue, 2...

CVE-2010-3301

The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x8664 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-boun...

Out-of-bounds

The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 do not properly validate an unspecified system-call argument, which allows local users to cause a denial of...

PT-2010-3510 · Microsoft · Windows Server 2003 +5

Name of the Vulnerable Software and Affected Versions: Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 version SP2 Microsoft Windows Vista versions SP1 through SP2 Microsoft Windows Server 2008 versions Gold through SP2 and R2 Microsoft Windows 7 Description: The issue...

Microsoft Windows Kernel Mode Drivers Privilege Elevation Vulnerabilities (2160329)

This host is missing a critical security update according to Microsoft Bulletin MS10-048. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

kernel security and bug fix update

2.6.9-89.0.28.0.1.EL - XEN fix cpu hotplug crash Joe Jin orabug 7521308 - XEN Bring up vcpus before khelper init Joe Jin orabug 7521308 - XEN flush the tlb cache immediately Dave McCracken, Scott Shi orabug 9138767 - fix skb alignment that was causing sendto to fail with EFAULT Olaf Kirch orabug...

FreeBSD mbuf本地权限提升漏洞

BUGTRAQ ID: 41577 CVE ID: CVE-2010-2693 FreeBSD就是一种运行在Intel平台上、可以自由使用的开放源码Unix类系统。 mbuf是FreeBSD内核进程间通讯和联网子系统中的基础内存管理单元。网络报文和套接字缓冲区依赖于mbuf进行存储。 在复制mbuf缓冲区引用时没有正确地拷贝只读标志，如果使用sendfile2系统调用在回环接口上传输数据，就可能导致修改所传送数据的后端内存页，造成数据破坏。本地攻击者可以通过精心控制系统文件的破坏情况来利用这种数据破坏提升权限。请注意攻击者可以破坏任意可读访问的文件。 FreeBSD FreeBSD 8....

Memory corruption

FreeBSD 7.1 through 8.1-PRERELEASE does not copy the read-only flag when creating a duplicate mbuf buffer reference, which allows local users to cause a denial of service system file corruption and gain privileges via the sendfile system call...

CVE-2010-2693

CVE-2010-2693 affects FreeBSD 7.1–8.1-PRERELEASE where the read-only flag is not copied when duplicating an mbuf buffer reference. This can allow a local attacker to cause data corruption via sendfile(2) on the loopback path and potentially escalate privileges by corrupting system files. The issu...

Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability

No description provided by source. Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry and some not from the industry have come together to form MSRC: the Microsoft-Spurned Researcher Collective. MSRC will fully disclose...

FreeBSD 8.07.37.2 - nfs_mount() Local Privilege Escalation

FreeBSD 8.07.37.2 - nfsmount Local Privilege Escalation / nfsmountex.c -- Patroklos Argyroudis, argp at domain census-labs.com Local kernel exploit for FreeBSD 8.0, 7.3 and 7.2. FreeBSD 8.0-RELEASE: Local kernel crash/denial-of-service. FreeBSD 7.3/7.2-RELEASE: Local privilege escalation...

FreeBSD Kernel nfs_mount() Exploit

Exploit for freebsd platform in category local exploits ================================== FreeBSD Kernel nfsmount Exploit ================================== / nfsmountex.c -- Patroklos Argyroudis, argp at domain census-labs.com Local kernel exploit for FreeBSD 8.0, 7.3 and 7.2. FreeBSD...

Sophos Anti-Virus NtQueryAttributesFile()系统调用本地权限提升漏洞

BUGTRAQ ID: 40715 Sophos Anti-Virus是一款适用于多种操作系统的杀毒软件。 Sophos杀毒软件所使用的savonaccessfilter.sys过滤器驱动没有正确地处理NtQueryAttributesFile系统调用参数参数，本地用户可以通过提交特制的IOCTL请求以ring 0权限执行任意代码。 Sophos Anti-Virus 7.6.20 厂商补丁： Sophos ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...