CVE-2007-1000

The ipv6getsockoptsticky function in net/ipv6/ipv6sockglue.c in the Linux kernel before 2.6.20.2 allows local users to read arbitrary kernel memory via certain getsockopt calls that trigger a NULL dereference...

Use google to carry out penetration testing-vulnerability warning-the black bar safety net

Today we are penetration testers in the implementation of the attack before, often the first information-gathering, which is the vulnerability is confirmed and the final exploits, expanding the war fruit. Here we are now going to talk about is: One, use google to find is people who installed a ph...

Multiple Printer Providers (spooler service) Privilege Escalation Exploit

No description provided by source. /Private exploit- internal use only Title: Universal exploit for vulnerable printer providers spooler service. Vulnerability: Insecure EnumPrintersW calls Author: Andres Tarasco Acu [email protected] Website: http://www.514.es This code should allow to gain SYSTEM...

DEBIAN-CVE-2007-0539

The wpremotefopen function in WordPress before 2.1 allows remote attackers to cause a denial of service bandwidth or thread consumption via pingback service calls with a source URI that corresponds to a large file, which triggers a long download session without a timeout constraint...

Multiple Printer Providers (Spooler Service) - Local Privilege Escalation

/Private exploit- internal use only Title: Universal exploit for vulnerable printer providers spooler service. Vulnerability: Insecure EnumPrintersW calls Author: Andres Tarasco Acuña - [email protected] Website: http://www.514.es This code should allow to gain SYSTEM privileges with the following...

Design/Logic Flaw

Getahead Direct Web Remoting DWR before 1.1.4 allows attackers to cause a denial of service memory exhaustion and servlet outage via unknown vectors related to a large number of calls in a batch...

Microsoft Windows CSRSS HardError Messages Denial of Service Vulnerability

Description Microsoft Windows is prone to a local denial-of-service vulnerability because the operating system fails to handle certain API calls with unexpected parameters. A local unprivileged attacker may exploit this issue by executing a malicious application. Successful exploits will allow...

Mandrake Linux Security Advisory : xorg-x11 (MDKSA-2006:160)

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit. In...

USN-395-1: Linux kernel vulnerabilities

Mark Dowd discovered that the netfilter iptables module did not correcly handle fragmented packets. By sending specially crafted packets, a remote attacker could exploit this to bypass firewall rules. This has only be fixed for Ubuntu 6.10; the corresponding fix for Ubuntu 5.10 and 6.06 will foll...

PT-2006-6355 · Canonical · Ubuntu

Name of the Vulnerable Software and Affected Versions: Ubuntu Linux version 6.10 for PowerPC PPC Description: The issue allows local users to cause a denial of service by consuming system resources. This is achieved by utilizing the sys get robust list and sys set robust list functions to create...

CVE-2006-6008

ftpd in Linux Netkit linux-ftpd 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different...

Novell Client 4.91 - NWSPOOL.dll Remote Buffer Overflow

Novell Client 4.91 - NWSPOOL.dll Remote Buffer Overflow // source: https://www.securityfocus.com/bid/21220/info Novell Client is prone to a remote buffer-overflow vulnerability. Successful exploits may result in a denial-of-service condition or arbitrary code execution. Remote, anonymous attacker...

Linux imapd Remote Overflow File Retrieve Exploit

No description provided by source. / This is the remote exploit of the hole in the imap daemon, for Linux. The instruction code is doing open, write, and close system calls, and it adds a line root::0:0.. at the beggining of /etc/passwd change to /etc/shadow if needed. The code needs to be self...

linux/x86 executes command after setreuid (9 + 40 bytes + cmd)

No description provided by source. / bunkerexec.c V1.3 - Tue Mar 21 22:50:18 CET 2006 Linux/x86 bytecode that executes command after setreuid 9 + 40 bytes + cmd setreuid0, 0 + execve"/bin//sh", "/bin//sh","-c","cmd", NULL; "cmd" MUST be terminated with ";" better with ";exit;" :-D bunker -...

Asterisk 1.0.121.2.12.1 - chan_skinny Remote Heap Overflow (PoC)

Asterisk 1.0.121.2.12.1 - chanskinny Remote Heap Overflow PoC !/usr/bin/perl Beyond Security Copyright Noam Rathaus The following proof of concept causes the chanskippy to crash in different locations and due to memory corruption as well as double free calls, this is based on the finding of...

Asterisk 1.0.12/1.2.12.1 - 'chan_skinny' Remote Heap Overflow (PoC)

!/usr/bin/perl Beyond Security Copyright Noam Rathaus The following proof of concept causes the chanskippy to crash in different locations and due to memory corruption as well as double free calls, this is based on the finding of Security-Assessment.com, and proves that the vulnerability is indee...

Kerio Personal Firewall privilege escalation

Insufficient hooked SSDT calls arguments validation...

CVE-2006-3083

The 1 krshd and 2 v4rcp applications in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges usi...

CVE-2006-3083

The 1 krshd and 2 v4rcp applications in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges usi...

CVE-2006-3084

The 1 ftpd and 2 ksu programs in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not kno...