Postfix Cyrus SASL Authentication Context Data Reuse Memory Corruption

According to its banner, the version of the Postfix mail server listening on this port is earlier than 2.5.13, 2.6.19, 2.7.4, or 2.8.3. Such versions may be vulnerable to a memory corruption attack if they have Cyrus SASL enabled and are allowing authentication methods other than ANONYMOUS, LOGIN...

Important: Red Hat Security Advisory: kernel-rt security and bug fix update

Updated kernel-rt packages that fix multiple security issues and various bugs are now available for Red Hat Enterprise MRG 1.3. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

Memory corruption in Postfix SMTP server Cyrus SASL support (CVE-2011-1720)

On-line version will be at http://www.postfix.org/CVE-2011-1720.html Summary ======= The Postfix SMTP server has a memory corruption error when the Cyrus SASL library is used with authentication mechanisms other than PLAIN and LOGIN the ANONYMOUS mechanism is unaffected but should not be enabled...

[SECURITY] Fedora 14 Update: polkit-0.98-5.fc14

PolicyKit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes...

openSUSE Security Update : fuse (openSUSE-SU-2011:0265-1)

Race conditions in fuse allowed unprivileged users to umount arbitrary mount points CVE-2011-0541,CVE-2010-3879,CVE-2011-0543. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update fuse-4183. The te...

SQL-Ledger 2.8.33 - (Authenticated) Local File Inclusion / Edit

Exploit Title: SQL-Ledger = 2.8.33 Post-authentication Local File Include/Edit Vulnerability Google Dork: inurl:/sql-ledger/login.pl Date: April 15, 2011 Author: bitform Software Link: http://www.sql-ledger.com/source/sql-ledger-2.8.33.tar.gz Version: 2.8.33 Tested on: Ubuntu Server 10.04 CVE :...

SQL-Ledger 2.8.33 - (Authenticated) Local File Inclusion Edit

SQL-Ledger 2.8.33 - Authenticated Local File Inclusion Edit Exploit Title: SQL-Ledger = 2.8.33 Post-authentication Local File Include/Edit Vulnerability Google Dork: inurl:/sql-ledger/login.pl Date: April 15, 2011 Author: bitform Software Link:...

Wamp Webserver 2.1 File Download

!/usr/bin/perl In The name of Allah Title : WampServer 2.1 Remote File Download Exploit Author : KedAns-Dz E-mail : [email protected] Home : HMD/AM 30008/04300 - Algeria -00213555248701 Twitter page : twitter.com/kedans platform : php Impact : Remote Content/Download File Tested on : Windows XP S...

Oracle Solaris 10 password hashes leaked through back-out patch files

Overview Oracle Solaris 10 back-out patch files undo.Z contain password hashes which may be readable by unprivileged users. Description The root password hash along with other users' password hashes may be contained in the back-out patch files. In some instances, these files may be readable by...

Solaris 10 Port Stealing Vulnerability

I reported this to Oracle, but I have been told that this is part of the BSD standard and a desire feature !. In a nutshell, as an ordinary user, I can bind to a port using a specific address even if another process is already bound to it with a wildcard address. This makes it very easy for an...

Directory traversal

The setup scripts in 389 Directory Server 1.2.x aka Red Hat Directory Server 8.2.x, when multiple unprivileged instances are configured, use 0777 permissions for the /var/run/dirsrv directory, which allows local users to cause a denial of service daemon outage or arbitrary process termination by...

RedHat Linux - Stickiness of /tmp

from: http://marc.info/?l=full-disclosure&m=129842239022495&w=2 Developers should not rely on the stickiness of /tmp on Red Hat Linux --------------------------------------------------------------------- Recent versions of Red Hat Enterprise Linux and Fedora provide seunshare, a setuid root utili...

Red Hat Enterprise Linux seunshare Unsafe Implementation

Developers should not rely on the stickiness of /tmp on Red Hat Linux --------------------------------------------------------------------- Recent versions of Red Hat Enterprise Linux and Fedora provide seunshare, a setuid root utility from policycore-utils intended to make new filesystem...

RedHat Linux - Stickiness of tmp

RedHat Linux - Stickiness of tmp from: http://marc.info/?l=full-disclosure&m=129842239022495&w=2 Developers should not rely on the stickiness of /tmp on Red Hat Linux --------------------------------------------------------------------- Recent versions of Red Hat Enterprise Linux and Fedora provi...

Server: insecure pid file directory permissions

The setup scripts in 389 Directory Server 1.2.x aka Red Hat Directory Server 8.2.x, when multiple unprivileged instances are configured, use 0777 permissions for the /var/run/dirsrv directory, which allows local users to cause a denial of service daemon outage or arbitrary process termination by...

Multiple Snap Appliance (SnapServer) Bypass Vulnerabilities

Exploit Title: Multiple Snap Appliance SnapServer Vulnerabilities Date: 13-02-2011 Author: SeeMe Vendor Link: http://www.overlandstorage.com/ Effected Versions: N/A Multiple SnapAppliance SnapServer suffers from Multi-vulnerabilities which allows unprivileged users to view and modify Storage-Data...

Windows Win32k Pointer Dereferencement PoC (MS10-098)

Exploit for windows platform in category dos / poc / MS10-098 CVE-2010-3944 Microsoft Windows Win32k pointer dereferencement -------------------- Affected Software ------------------------ Microsoft Windows 7 / 2008 -------------------- Consequences ----------------------- An unprivileged user ma...

Linux Kernel 2.6.37-rc2 - ACPI custom_method Local Privilege Escalation

Linux Kernel 2.6.37-rc2 - ACPI custommethod Local Privilege Escalation / american-sign-language.c Linux Kernel http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4347 This custommethod file allows to inject custom ACPI methods into the ACPI interpreter...

Windows Win32k Pointer Dereference

/ MS10-098 CVE-2010-3944 Microsoft Windows Win32k pointer dereferencement -------------------- Affected Software ------------------------ Microsoft Windows 7 / 2008 -------------------- Consequences ----------------------- An unprivileged user may be able to cause a bugcheck, or possibly execute...

Microsoft Windows - Win32k Pointer Dereferencement (PoC) (MS10-098)

/ MS10-098 CVE-2010-3944 Microsoft Windows Win32k pointer dereferencement -------------------- Affected Software ------------------------ Microsoft Windows 7 / 2008 -------------------- Consequences ----------------------- An unprivileged user may be able to cause a bugcheck, or possibly execute...