ISC BIND (Linux/BSD) - Remote Buffer Overflow (1)

/ source: https://www.securityfocus.com/bid/134/info A buffer overflow exists in certain versions of BIND, the nameserver daemon currently maintained by the Internet Software Consortium ISC. BIND fails to properly bound the data recieved when processing an inverse query. Upon a memory copy,...

CVE-1999-0304

mmap function in BSD allows local attackers in the kmem group to modify memory through devices...

CVE-1999-0305

The system configuration control sysctl facility in BSD based operating systems OpenBSD 2.2 and earlier, and FreeBSD 2.2.5 and earlier, does not properly restrict source routed packets even when the 1 dosourceroute or 2 forwarding variables are set, which allows remote attackers to spoof TCP...

CVE-1999-0061

File creation and deletion, and remote execution, in the BSD line printer daemon lpd...

CVE-1999-1402

The access permissions for a UNIX domain socket are ignored in Solaris 2.x and SunOS 4.x, and other BSD-based operating systems before 4.4, which could allow local users to connect to the socket and possibly disrupt or control the operations of the program using that socket...

BSD/OS 2.1/3.0 / Larry Wall Perl 5.0 03 / RedHat 4.0/4.1 / SGI Freeware 1.0/2.0 SUIDPerl - Local Overflow (1)

source: https://www.securityfocus.com/bid/708/info Several buffer overflows were found in the Perl helper application 'suidperl' or 'sperl'. When this program is installed setuid root the overflows may lead to a local root compromise. !/usr/bin/perl yes, this suidperl exploit is in perl, isn't it...

SGI IRIX 6.4 - 'netprint' Local Privilege Escalation

source: https://www.securityfocus.com/bid/395/info A vulnerability exists in the netprint program, shipping with Irix 6.x and 5.x by Silicon Graphics. The netprint program calls the "disable" command via a system call, without specifying an explicit path. Therefore, any program in the path named...

CVE-1999-0032

Buffer overflow in lpr, as used in BSD-based systems including Linux, allows local users to execute arbitrary code as root via a long -C classification command line option...

BSD Linux - lpr Local Privilege Escalation

BSD Linux - lpr Local Privilege Escalation -------------------------------------- linuxlprexploit.c ---------- include include include define DEFAULTOFFSET 50 define BUFFERSIZE 1023 long getespvoid asm"movl %esp,%eax\n"; void main char buff = NULL; unsigned long addrptr = NULL; char ptr = NULL;...

BSD / Linux - 'lpr' Local Privilege Escalation

-------------------------------------- linuxlprexploit.c ---------- include include include define DEFAULTOFFSET 50 define BUFFERSIZE 1023 long getespvoid asm"movl %esp,%eax\n"; void main char buff = NULL; unsigned long addrptr = NULL; char ptr = NULL; uchar execshell =...

BSDOS 2.1 FreeBSD 2.1.5 NeXTstep 4.x IRIX 6.4 SunOS 4.1.34.1.4 - lpr Buffer Overrun (1)

BSDOS 2.1 FreeBSD 2.1.5 NeXTstep 4.x IRIX 6.4 SunOS 4.1.34.1.4 - lpr Buffer Overrun 1 / source: https://www.securityfocus.com/bid/707/info BSD/OS 2.1,FreeBSD 2.1.5,NeXTstep 4.0/4.1,SGI IRIX 6.4,SunOS 4.1.3/4.1.4 lpr Buffer Overrun Vulnerability 1 Due to insufficient bounds checking on arguments i...

BSD and Linux lpr Command Local Root Exploit

Exploit for linux platform in category local exploits ============================================ BSD and Linux lpr Command Local Root Exploit ============================================ -------------------------------------- linuxlprexploit.c ---------- include include include define...

BSD/OS 2.1 / FreeBSD 2.1.5 / NeXTstep 4.x / IRIX 6.4 / SunOS 4.1.3/4.1.4 - 'lpr' Buffer Overrun (1)

/ source: https://www.securityfocus.com/bid/707/info BSD/OS 2.1,FreeBSD 2.1.5,NeXTstep 4.0/4.1,SGI IRIX 6.4,SunOS 4.1.3/4.1.4 lpr Buffer Overrun Vulnerability 1 Due to insufficient bounds checking on arguments in this case -C which are supplied by users, it is possible to overwrite the internal...

BSD / Linux - 'umount' Local Privilege Escalation

/ Reminder - Be sure to fix the includes /str0ke / -------------------------------------- linuxumountexploit.c ---------- include include include include include include define PATHMOUNT "/bin/umount" define BUFFERSIZE 1024 define DEFAULTOFFSET 50 ulong getesp asm"movl %esp, %eax"; mainint argc,...

Linux & BSD umount Local Root Exploit

Exploit for multiple platform in category local exploits ===================================== Linux & BSD umount Local Root Exploit ===================================== / Reminder - Be sure to fix the includes /str0ke / -------------------------------------- linuxumountexploit.c ----------...

BSDI BSD/OS 2.1 / FreeBSD 2.1 / IBM AIX 4.2 / SGI IRIX 6.4 / Sun SunOS 4.1.3 - Buffer Overrun

/ source: https://www.securityfocus.com/bid/129/info Rdist is a program to maintain identical copies of files over multiple hosts. It preserves the owner, group, mode, and mtime of files if possible and can update programs that are executing. Rdist reads commands from distfile to direct the...

CVE-1999-1098

Vulnerability in BSD Telnet client with encryption and Kerberos 4 authentication allows remote attackers to decrypt the session via sniffing...

CVE-1999-1471

Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by specifying a long shell or GECOS field...