956 matches found
CVE-2008-3875
The kernel in Sun Solaris 8 through 10 and OpenSolaris before snv90 allows local users to bypass chroot, zones, and the Solaris Trusted Extensions multi-level security policy, and establish a covert communication channel, via unspecified vectors involving system calls...
CVE-2008-3875
The kernel in Sun Solaris 8 through 10 and OpenSolaris before snv90 allows local users to bypass chroot, zones, and the Solaris Trusted Extensions multi-level security policy, and establish a covert communication channel, via unspecified vectors involving system calls...
PHP 5.2.6 sleep() Local Memory Exhaust Exploit
No description provided by source. ?php sleep9999999; echo 'Hello World'; ? Will print hello world after 9999999 seconds... so maxexecutiontime simply dosnt work :P Why? we can find in manual:...
function sleep() in all versions of PHP
There is a quite big problem with sleep function in php, The maxexecutiontime set to 60sec. in safe mode can be easy passed by using sleep funcion, for example this script: ?php sleep9999999; echo 'Hello World'; ? Will print hello world after 9999999 seconds... so maxexecutiontime simply dosnt wo...
Light into the light out of the Liunx Shellcode-exploit warning-the black bar safety net
/------------- Author:merry-go-round of wood the B. C. T [email protected] Date:2008/05/12 Website:www.bugshower.org -------------/ A: What is shellcode Saying one day some Patriotic hackers compiled a Nday overflow exploit program to attack the CNN, the input IP and enter after the discovery of...
CVE-2008-1115
Unspecified vulnerability in Sun Solaris 8 directory functions allows local users to cause a denial of service panic via an unspecified sequence of system calls or commands...
Pulseaudio: Privilege escalation
Background Pulseaudio is a networked sound server with an advanced plugin system. Description Marcus Meissner from SUSE reported that the padroproot function does not properly check the return value of the system calls setuid, seteuid, setresuid and setreuid when dropping its privileges. Impact A...
Ubuntu 5.04 / 5.10 / 6.06 LTS : krb5 vulnerabilities (USN-334-1)
Michael Calmer and Marcus Meissner discovered that several krb5 tools did not check the return values from setuid system calls. On systems that have configured user process limits, it may be possible for an attacker to cause setuid to fail via resource starvation. In that situation, the tools wil...
[SECURITY] Fedora 7 Update: python-2.5-14.fc7
Python is an interpreted, interactive, object-oriented programming language often compared to Tcl, Perl, Scheme or Java. Python includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as t...
Use google to carry out penetration testing-vulnerability warning-the black bar safety net
Today we are penetration testers in the implementation of the attack before, often the first information-gathering, which is the vulnerability is confirmed and the final exploits, expanding the war fruit. Here we are now going to talk about is: One, use google to find is people who installed a ph...
USN-395-1: Linux kernel vulnerabilities
Mark Dowd discovered that the netfilter iptables module did not correcly handle fragmented packets. By sending specially crafted packets, a remote attacker could exploit this to bypass firewall rules. This has only be fixed for Ubuntu 6.10; the corresponding fix for Ubuntu 5.10 and 6.06 will foll...
PT-2006-6355 · Canonical · Ubuntu
Name of the Vulnerable Software and Affected Versions: Ubuntu Linux version 6.10 for PowerPC PPC Description: The issue allows local users to cause a denial of service by consuming system resources. This is achieved by utilizing the sys get robust list and sys set robust list functions to create...
Linux imapd Remote Overflow File Retrieve Exploit
No description provided by source. / This is the remote exploit of the hole in the imap daemon, for Linux. The instruction code is doing open, write, and close system calls, and it adds a line root::0:0.. at the beggining of /etc/passwd change to /etc/shadow if needed. The code needs to be self...
linux/x86 executes command after setreuid (9 + 40 bytes + cmd)
No description provided by source. / bunkerexec.c V1.3 - Tue Mar 21 22:50:18 CET 2006 Linux/x86 bytecode that executes command after setreuid 9 + 40 bytes + cmd setreuid0, 0 + execve"/bin//sh", "/bin//sh","-c","cmd", NULL; "cmd" MUST be terminated with ";" better with ";exit;" :-D bunker -...
CentOS 3 : kernel (CESA-2006:0437)
Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the eighth regular update. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles...
linux/x86 TCP Proxy Shellcode 236 bytes
No description provided by source. // proxylib.c - is located at http://www.milw0rm.com/id.php?id=1476 /str0ke / hey all.. this is my attempt at a very small very functional tcp proxy shellcode.. to pull this off i ignored the "socks" protocols and invented my own.. sorta.. how to use me.. delive...
solaris/sparc setreuid/execve 56 bytes
No description provided by source. / [email protected] setreuid shellcode full description of how it was done and defines at http://www.telegenetic.net/sparc-shellcode.htm / char shellcode = "\x90\x1A\x40\x09" / xor %o1, %o1, %o0 / "\x92\x1A\x40\x09" / xor %o1, %o1, %o1 / "\x82\x10\x20\xCA" /...
CVE-2001-1559
The CVE-2001-1559 issue affects OpenBSD 2.9 and 3.0, where the uipc_syscalls.c logic returns user-mode values to the fdrelease kernel function, enabling local users to trigger a denial of service and a null dereference. The root cause is the mismatched value returned by uipc system calls to a ker...
remote command execution in 'tattle'
Hello, a recent bugtraq posting by CISSP C.J. Steele contains a vulnerability which will leave a box possibly open for remote command execution. There are many ways to exploit this, but I chose logging in through ftp with username like sshd rhost 9 10 11 |rm$IFS-rf$IFS/|echo'1.1.1.1' because of...
phpDEV5 System-Call Local Denial of Service Exploit
Exploit for unknown platform in category dos / poc =================================================== phpDEV5 System-Call Local Denial of Service Exploit =================================================== ------------------------------------------------------------------------ PHPDev5 Target :...