hylafax

There are some format strings vulnerbilities in the lastest hylafax package try faxrm -h x 1 or faxalter -h x -D 1 for "proof of concept". Both faxrm and faxalter are installed setuid uucp on FreeBSD installed from port collection. uid uucp is not that exciting but with some luck you'll find uucp...

CVE-2001-0456

Summary: CVE-2001-0456 affects ProFTPD in Debian 2.2 where the postinst script fails to properly adjust the “run as uid/gid root” setting when anonymous access is enabled, causing the server to run with elevated privileges. What’s affected: proftpd on Debian 2.2 (potato); issue in post-install co...

CVE-1999-1299

CVE-1999-1299 concerns rcp on various Linux systems, including Red Hat 4.0. Root cause: UID 65535 is interpreted as -1 by chown and related system calls, causing ownership changes to fail and potentially allow a nobody or UID 65535 to overwrite arbitrary files. Impact: writable/overwritable files...

CVE-1999-1299

rcp on various Linux systems including Red Hat 4.0 allows a "nobody" user or other user with UID of 65535 to overwrite arbitrary files, since 65535 is interpreted as -1 by chown and other system calls, which causes the calls to fail to modify the ownership of the file...

CVE-1999-1308: Undefined Security Weakness

Certain programs in HP-UX 10.20 do not properly handle large user IDs UID or group IDs GID over 60000, which could allow local users to gain privileges...

CVE-1999-1299: Undefined Security Weakness

rcp on various Linux systems including Red Hat 4.0 allows a "nobody" user or other user with UID of 65535 to overwrite arbitrary files, since 65535 is interpreted as -1 by chown and other system calls, which causes the calls to fail to modify the ownership of the file...

Multiple vendor 'Taylor UUCP' problems.

Brief description Due to incorrect argument handling in a component of the Taylor UUCP package, it is possible for local users to gain uid/gid uucp. This may allow further elevation, depending on the system, up to and including root access. On OpenBSD 2.8 and probably others it allows root...

Solaris whodo Vulnerability

Vulnerability in Solaris whodo Date Published: July 5, 2001 Advisory ID: N/A Bugtraq ID: 2935 CVE CAN: Non currently assigned. Title: Solaris whodo Buffer Overflow Vulnerability Class: Boundary Error Condition Remotely Exploitable: No Locally Exploitable: Yes Vulnerability Description: The whodo...

PHP Safe Mode mail Function 5th Parameter Arbitrary Command Execution

The remote host is running PHP 4.0.5. There is a flaw in this version of PHP that allows local users to circumvent the safe mode and to gain the UID of the HTTP process. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. References: Date: Fri, 23 Aug 2002 09:30:40 +0200 CEST From: "Wojciech...

PHP 4.x - SafeMode Arbitrary File Execution

source: https://www.securityfocus.com/bid/2954/info PHP is the Personal HomePage development toolkit, distributed by the PHP.net, and maintained by the PHP Development Team in public domain. A problem with the toolkit could allow elevated privileges, and potentially unauthorized access to...

Дырка в innfeed (buffer overflow)

Классическое переполнение буфера дает возможность получения uid news и возможно uid root пользователям имеющим gid news...

whois.cgi.txt

Metacharacterbug in the Fastgraf whois.cgi perlscript ----------------------------------------------------- Author : Fastgraf c All rights reserved. url : http://www.fastgraf.com realeasedate : 03/01/99 Problem: The whois.cgi script of Fastgraf has almost no metacharcterchecking which enables...

xconq7.4.1 exploit.

i saw some mention of xconq on bugtraq, but no exploit. decided to take a lookie at it...took a little more work than expected to successfully exploitwithout a display, but none-the-less: originalunwarpped/working: http://realhalo.org/xxconq.c xxconq.cwrapped:...

IBM AIX 4.3 - usrliblpddigest Local Buffer Overflow

IBM AIX 4.3 - usrliblpddigest Local Buffer Overflow / source: https://www.securityfocus.com/bid/2033/info AIX is a version of the UNIX Operating System distributed by IBM. A vulnerability exists in the operating system which could allow a user an elevation in priviledge. The problem occurs in the...

IBM AIX 4.3 - '/usr/lib/lpd/digest' Local Buffer Overflow

/ source: https://www.securityfocus.com/bid/2033/info AIX is a version of the UNIX Operating System distributed by IBM. A vulnerability exists in the operating system which could allow a user an elevation in priviledge. The problem occurs in the digest binary. It is reported that it is possible t...

LIDS severe bug

Hi. Didn't see a message regarding this one here, so here we go... This is from the Linux Intrusion Detection System LIDS/www.lids.org mailing list. Basically LIDS 0.9.7 for kernel 2.2.16 breaks the system so that every user is acting as uid=0 when the system has been started with /security=0 at...

rh 6.2 - gid compromises, etc

Probably it's nothing exciting, but several packets supplied with RH 6.2 will allow 500 gid/uid compromises. On every system it HAS some kind of meaning - sometimes just a little exceeding quotas, hiding from accounting, anonymous intrusions to other systems - but sometimes compromised uucp or ne...

Удаленная дырка в innd

Классическое переполнение буфера в функции sprintf. Теоретически позволяет выполнение кода uid news...

Various Lame Stuff

Hi all, Just a summary of some vulnerabilities that have been covered in the Forbidden Knowledge e-zine lately, which some people on the list may need to know... Covered in Issue Eight --- Proxy Plus www.proxyplus.cz has various insecure default settings. NiteServer FTPd is vulnerable to several...

Buffer overflows in Skyline/SpinBox client

There are some buffer overflows in SpinBox/1.1 from the spinserver.conf. SpinBox is an SSI/cgi-tool used by advertisement companies, made by Skyline. Since this is closed source software, I can't post the sources. The buffer overflows are mostly in the query string strcat and strcpy instead of...