CVE-2009-0028

CVE-2009-0028 is a local vulnerability in the Linux kernel up to version 2.6.28 where the clone system call with CLONE_PARENT can allow an unprivileged child to spawn a second child and exit, enabling it to send arbitrary signals to the parent process. The MiracleLinux AXSA-2009-42:04 advisory ex...

CentOS Update for kernel CESA-2008:0508 centos4 x86_64

Check for the Version of kernel OpenVAS Vulnerability Test CentOS Update for kernel CESA-2008:0508 centos4 x8664 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

linux/x86 file reader 65 bytes + pathname

linux/x86 file reader 65 bytes + pathname. Shellcode exploit for linx86 platform / Linux/x86 file reader. 65 bytes + pathname Author: certaindeath Source code: start: xor %eax, %eax xor %ebx, %ebx xor %ecx, %ecx xor %edx, %edx jmp two one: pop %ebx movb $5, %al xor %ecx, %ecx int $0x80 mov %eax,...

Linux/x86 - setuid(0) && execve() - 25 bytes

No description provided by source. Hi, i've shrinked down the shellcode to 25 bytes, the smallest setuid & execve GNU/Linux shellcode without nulls that spawns a shell. -------------------------------------------------------------------------------------- SMALLEST SETUID & EXECVE GNU/LINUX x86...

Design/Logic Flaw

The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service...

CVE-2009-0029

The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service...

CVE-2009-0029

This CVE affects the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms. The root cause is that a 32-bit user-space argument in a 64‑bit register was not verifiably sign-extended when passed to a system call, allowing local users to crash the kernel or potentiall...

Linux Kernel 64 Bit ABI系统调用参数特权提升漏洞

BUGTRAQ ID: 33275 CVE ID：CVE-2009-0029 Linux是一款开放源代码的操作系统。 Linux内核64位ABI系统调用参数处理存在问题，本地攻击者可以利用漏洞提升特权。 部分结构的ABI定义函数调用者必须对每个参数进行符号扩展来填满寄存器宽度，在linux系统调用处理上存在问题。 如在64位上使用这个系统调用： asmlinkage long sysexampleunsigned int index if index 5 return -EINVAL; return examplearrayindex;...

Fujitsu-Siemens WebTransactions shell characters vulnerability

Unfiltered user input in systemcall...

Linux Kernel MIPS系统调用本地拒绝服务漏洞

BUGTRAQ ID: 32716 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的arch/mips/kernel/scall64-o32.S文件中存在越界数组访问漏洞。如果本地用户用小于4000的系统调用号执行o32系统调用的话，就会导致系统崩溃。 Linux kernel 2.6.x Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.28-rc7-git6.log...

kernel: missing boundary checks in syscall/syscall32_nopage()

Tavis Ormandy reported missing boundary checks in the Virtual Dynamic Shared Objects vDSO implementation. This could allow a local unprivileged user to cause a denial of service or privilege escalation. CVE-2008-3527, Important...

Linux Kernel proc_do_xprt()函数本地栈溢出漏洞

BUGTRAQ ID: 31937 CVECAN ID: CVE-2008-3911 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的net/sunrpc/sysctl.c文件中的procdoxprt函数没有检查某些从用户域所获得缓冲区的长度，本地攻击者可以通过对/proc/sys/sunrpc/transports文件特制的读系统调用触发栈溢出，导致执行任意指令。 Linux kernel 2.6.26.3 Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

linux/x86 system-beep shellcode 45 bytes

Exploit for linux/x86 platform in category shellcode ======================================== linux/x86 system-beep shellcode 45 bytes ======================================== / By Thomas Rinsma 16 apr. 2008 Shellcode makes system speaker beep once, 45 bytes: ; int fd = open"/dev/tty10", ORDONLY;...

CVE-2008-3531

Stack-based buffer overflow in sys/kern/vfsmount.c in the kernel in FreeBSD 7.0 and 7.1, when vfs.usermount is enabled, allows local users to gain privileges via a crafted 1 mount or 2 nmount system call, related to copying of "user defined data" in "certain error conditions."...

CVE-2008-3911

The procdoxprt function in net/sunrpc/sysctl.c in the Linux kernel 2.6.26.3 does not check the length of a certain buffer obtained from userspace, which allows local users to overflow a stack-based buffer and have unspecified other impact via a crafted read system call for the...

CVE-2008-3911

The procdoxprt function in net/sunrpc/sysctl.c in the Linux kernel 2.6.26.3 does not check the length of a certain buffer obtained from userspace, which allows local users to overflow a stack-based buffer and have unspecified other impact via a crafted read system call for the...

CVE-2008-3911

The procdoxprt function in net/sunrpc/sysctl.c in the Linux kernel 2.6.26.3 does not check the length of a certain buffer obtained from userspace, which allows local users to overflow a stack-based buffer and have unspecified other impact via a crafted read system call for the...

FreeBSD Security Advisory (FreeBSD-SA-04:11.msync.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-04:11.msync.asc ADV FreeBSD-SA-04:11.msync.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft...

FreeBSD Security Advisory (FreeBSD-SA-04:12.jailroute.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-04:12.jailroute.asc ADV FreeBSD-SA-04:12.jailroute.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008...

FreeBSD Security Advisory (FreeBSD-SA-07:01.jail.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-07:01.jail.asc ADV FreeBSD-SA-07:01.jail.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft In...