kernel: don't allow splice() to files opened with O_APPEND

The dosplicefrom function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the OAPPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file...

linux/x86 - append rsa key to /root/.ssh/authorized_keys2 295 bytes

linux/x86 append rsa key to /root/.ssh/authorizedkeys2 295 bytes. Shellcode exploit for linx86 platform / linux/x86 shellcode to append rsa key to /root/.ssh/authorizedkeys2 keys found at http://xenomuta.tuxfamily.org/exploits/authkey/ ssh -i idrsapwn root@pwned-host 295 bytes by XenoMuta | |/ / ...

linux/x86 append rsa key to /root/.ssh/authorized_keys2 295 bytes

No description provided by source. / linux/x86 shellcode to append rsa key to /root/.ssh/authorizedkeys2 keys found at http://xenomuta.tuxfamily.org/exploits/authkey/ ssh -i idrsapwn root@pwned-host 295 bytes by XenoMuta | |/ / / |/ / / / | / / / / /|/ / / / / / / / / / / / / // / / / / // / //...

linux/x86 append rsa key to /root/.ssh/authorized_keys2 295 bytes

Exploit for linux/x86 platform in category shellcode ================================================================= linux/x86 append rsa key to /root/.ssh/authorizedkeys2 295 bytes ================================================================= / linux/x86 shellcode to append rsa key to...

CVE-2008-5155

mail2sms.sh in smsclient 2.0.8z allows local users to overwrite arbitrary files via a symlink attack on a 1 /tmp/header. or 2 /tmp/body. temporary file, or append data to arbitrary files via a symlink attack on the 3 /tmp/sms.log temporary file...

CVE-2008-4554

The dosplicefrom function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the OAPPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file...

Remote file inclusion

The dosplicefrom function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the OAPPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file...

CVE-2008-4554

The dosplicefrom function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the OAPPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file...

CVE-2008-4554

CVE-2008-4554 affects the Linux kernel in the do_splice_from function (fs/splice.c). Before 2.6.27, it does not reject file descriptors with the O_APPEND flag, allowing a local attacker to bypass append mode and make arbitrary changes to other parts of a file. The vulnerability is tied to the ker...

Gentoo Security Advisory GLSA 200808-12 (postfix)

The remote host is missing updates announced in advisory GLSA 200808-12. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SurgeMail IMAP服务APPEND命令远程溢出漏洞

BUGTRAQ ID: 30000 SurgeMail是下一代的邮件服务器，可运行在Windows NT/2K或UNIX平台上，支持所有的标准IMAP、POP3、SMTP、SSL和ESMTP协议。 SurgeMail的IMAP服务器存在缓冲区溢出漏洞，如果远程攻击者向IMAP服务提交了带有超长参数的APPEND命令的话，就可以触发这个溢出，导致服务器崩溃。 NetWin SurgeMail 3.9e NetWin ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://netwinsite.com/ A01 LOGIN username...

Surgemail IMAP server DoS

Crash on APPEND command processing...

CVE-2008-4041

The IMAP server in Softalk Mail Server formerly WorkgroupMail 8.5.1.431 allows remote authenticated users to cause a denial of service resource consumption and daemon crash via a long IMAP APPEND command with certain repeated parameters...

Softalk Mail Server 'APPEND'命令远程拒绝服务漏洞

BUGTRAQ ID: 30970 CNCAN ID：CNCAN-2008090309 Softalk Mail Server是一款邮件服务程序。 Softalk Mail Server IMAP服务不正确处理APPEND命令，远程攻击者可以利用漏洞对服务程序进行拒绝服务攻击。 提交特殊构建的APPEND命令给IMAP服务处理，可导致应用程序崩溃。 Softalk Mail Server 8.5.1 目前没有解决方案提供： http://www.softalkltd.com/ A001 LOGIN user password A01 APPEND Ax5000 UIDNEXT...

Softalk IMAP Server DoS

IMAP APPEND command handling vulnerability...

CVE-2008-2936

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending ...

CVE-2008-2936

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending ...

ruby: Integer overflows in rb_str_buf_append()

Multiple integer overflows in the rbstrbufappend function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that...

SurgeMail IMAP Service 'APPEND'命令远程缓冲区溢出漏洞

BUGTRAQ ID: 30000 CNCAN ID：CNCAN-2008070103 Surgemail是一款邮件服务程序。 Surgemail处理'APPEND'命令存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 提交超长字符串作为'APPEND'命令，可触发IMAP服务崩溃，造成缓冲区溢出，可能以应用程序权限执行任意指令。 NetWin SurgeMail 3.9e 目前没有详细解决方案提供： http://www.rss-aggregator.com/ http://www.sebug.net/exploit/3999...

Surgemail 39e-1 - (Authenticated) IMAP Remote Buffer Overflow (Denial of Service) (PoC)

!/usr/bin/python Surgemail version 39e-1 - 0day Post Auth IMAP Buffer overflow DoS. Discovered by: Travis Warren The IMAP service contains a buffer overflow in the APPEND command. import socket s = socket.socketsocket.AFINET, socket.SOCKSTREAM buffer = '\x41' 3000 s.connect'192.168.0.103',143...