Microsoft Windows Server 2000 - Universal Language Utility Manager (MS04-019)

/ COROMPUTER2004 Crpt Utility Manager exploit v1.666 modified by kralor Crpt It gets system language and sets windows names to work on any win2k :P Feel free to add other languages : You know where we are.. COROMPUTER2004 / / original disclaimer / //by Cesar Cerrudo sqlsecat include struct int id...

CVE-2004-0213

CVE-2004-0213 - Windows 2000 Utility Manager Privilege Elevation : The flaw occurs when Utility Manager launches winhlp32.exe with Local System privileges. A locally authenticated user can exploit a Shatter-style sequence by sending crafted Windows messages to Utility Manager to trigger winhlp32 ...

CVE-2004-0213

Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context...

PT-2004-1378 · Microsoft · Winhlp32.Exe +2

Name of the Vulnerable Software and Affected Versions: Windows 2000 Description: The issue allows local users to gain system privileges via a "Shatter" style attack. This is achieved by sending a Windows message to Utility Manager, which launches winhlp32.exe with raised privileges. The attack...

Microsoft Windows Utility Manager launches applications with system privileges

Overview The Microsoft Windows 2000 Utility Manager allows authenticated local users to launch applications with SYSTEM privileges. Description The Microsoft Windows 2000 Utility Manager is a program that permits users to monitor and launch various accessibility applications. This program contain...

Microsoft Windows Server 2000 - Utility Manager Privilege Escalation (MS04-019)

//by Cesar Cerrudo sqlsec at yahoo.com //Local elevation of priviliges exploit for Windows 2K Utility Manager second one!!!! //Gives you a shell with system privileges //If you have problems try changing Sleep values. include "stdio.h" include "windows.h" int mainint argc, char argv HWND lHandle,...

Microsoft Windows Server 2000 - Utility Manager Privilege Escalation (MS04-019)

Microsoft Windows Server 2000 - Utility Manager Privilege Escalation MS04-019 //by Cesar Cerrudo sqlsec at yahoo.com //Local elevation of priviliges exploit for Windows 2K Utility Manager second one!!!! //Gives you a shell with system privileges //If you have problems try changing Sleep values...

MS Windows 2000 Utility Manager Privilege Elevation Exploit (MS04-019)

Exploit for unknown platform in category local exploits ====================================================================== MS Windows 2000 Utility Manager Privilege Elevation Exploit MS04-019 ====================================================================== //by Cesar Cerrudo sqlsec at...

Microsoft Window Utility Manager Local Elevation of Privileges

Microsoft Window Utility Manager Local Elevation of Privileges July 13, 2004 Credit: This vulnerability was researched and discovered by Cesar Cerrudo. Risk Level: High Summary: A local elevation of privileges exists in the Windows Utility Manager which allows any user to take complete control ov...

Microsoft Windows Utility Manager Local Privilege Escalation Variant Vulnerability

Description Microsoft Utility Manager is prone to a local privilege escalation vulnerability. It is reported that a local user may influence the Utility Manager into executing an attacker-supplied application with elevated privileges. The cause of this issue is that the Utility Manager will attem...

IM-Switch - Insecure Temporary File Handling Symbolic Link

source: https://www.securityfocus.com/bid/10717/info IM-Switch Insecure Temporary File Handling Symbolic Link VulnerabilityIt is reported that im-switch is prone to a local insecure temporary file handling symbolic link vulnerability. This issue is due to a design error that allows the applicatio...

IM-Switch - Insecure Temporary File Handling Symbolic Link

IM-Switch - Insecure Temporary File Handling Symbolic Link source: https://www.securityfocus.com/bid/10717/info IM-Switch Insecure Temporary File Handling Symbolic Link VulnerabilityIt is reported that im-switch is prone to a local insecure temporary file handling symbolic link vulnerability. Thi...

Solaris 8 (sparc) : 110957-02

SunOS 5.8: /usr/bin/mailx patch. Date this patch was last updated by Sun : Nov/06/01 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

RHEL 2.1 / 3 : utempter (RHSA-2004:174)

An updated utempter package that fixes a potential symlink vulnerability is now available. Utempter is a utility that allows terminal applications such as xterm and screen to update utmp and wtmp without requiring root privileges. Steve Grubb discovered a flaw in Utempter which allowed device nam...

RHEL 2.1 : util-linux (RHSA-2002:137)

The util-linux package shipped with Red Hat Linux Advanced Server contains a locally exploitable vulnerability. The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. The 'chfn' utility included in this package allows users...

RHEL 2.1 : unzip (RHSA-2003:200)

Updated unzip packages resolving a vulnerability allowing arbitrary files to be overwritten are now available. Updated 15 August 2003 Ben Laurie found that the original patch to fix this issue missed a case where the path component included a quoted slash. These updated packages contain a new pat...

RHEL 2.1 : sharutils (RHSA-2003:180)

Updated packages for sharutils which fix potential privilege escalation using the uudecode utility are available. The sharutils package contains a set of tools for encoding and decoding packages of files in binary or text format. The uudecode utility creates an output file without checking to see...

gzip: Insecure creation of temporary files

Background gzip GNU zip is popular compression program. The included gzexe utility allows you to compress executables in place and have them automatically uncompress and execute when you run them. Description The script gzexe included with gzip contains a bug in the code that handles tempfile...

LHA 1.x - extract_one Multiple Buffer Overflow Vulnerabilities

LHA 1.x - extractone Multiple Buffer Overflow Vulnerabilities //source: https://www.securityfocus.com/bid/10354/info // //LHA has been reported prone to multiple vulnerabilities that may allow a malicious archive to execute arbitrary code or corrupt arbitrary files when the archive is operated on...

WGet 1.x - Insecure File Creation Race Condition

WGet 1.x - Insecure File Creation Race Condition source: https://www.securityfocus.com/bid/10361/info The 'wget' utility has been reported prone to a race-condition vulnerability. The issue exists because wget doesn't lock files that it creates and writes to during file downloads. A local attacke...