RedHat 6.2 Restore and Dump - Local Privilege Escalation

!/usr/bin/perl perl exploit of restore and dump redhat linux 6.2 written by tlabs Use at your discretion $EXPORT1="TAPE=garbage:garbage" ; $EXPORT2="RSH=./hey" ; sub USAGE print "$0 \n1=dump 2=dump.static 3=restore 4=restore.staic\nYour choice innit;\nWritten by Tlabs\n" ; exit 0 ; sub ERROR prin...

quakeworldex.txt

tested on qwsv-2.30-glibc-i386-unknown-linux2.0 The Quakeworld server unix rcon feature contains a buffer overflow which crashes the server, segfaults and core dumps. There are a bunch of different quakeworld servers out, picking a different one would probably be a good idea. RCONEX by...

Redhat 6.2 dump command executes external program with suid priviledge.

Problem: Linux dump command executes external program with suid priviledge. 2. Tested Version dump-0.4b15 3. Example mat@localhost mat$ export TAPE=garbage:garbage mat@localhost mat$ export RSH=/home/mat/executethis mat@localhost mat$ cat /home/mat/executethis !/bin/sh cp /bin/sh /home/mat/sh...

CVE-2000-0366

CVE-2000-0366 affects Debian GNU/Linux 2.1 where a dump utility fails to properly restore symlinks. This can allow a local user to modify ownership of arbitrary files due to incorrect handling of symbolic links during restoration. The core issue is the improper restoration of symlinks, enabling o...

CVE-2000-0520

CVE-2000-0520 describes a local buffer overflow in the restore program (version 0.4b17 and earlier) within the dump package. The vulnerability allows a local attacker to execute arbitrary commands by supplying a long tape name. Public details in the provided documents do not list affected platfor...

CVE-2000-0372

CVE-2000-0372 describes a local privilege escalation in Caldera’s rmt command within the dump package 0.4b4, enabling a local user to gain root privileges. The vulnerability is supported by NVD data (CVSSv2 base score 7.2; LOCAL access; no authentication; full confidentiality, integrity, and avai...

Переполнение буфера в dump (restore)

Классические переполнения буфера при указании имени ленты...

Stelian Pop dump 0.4 - restore Buffer Overflow

Stelian Pop dump 0.4 - restore Buffer Overflow // source: https://www.securityfocus.com/bid/1330/info A buffer overflow exists in the 'restore' program, part of the dump 0.4b15-1 package, distributed with RedHat Linux 6.2. By supplying a long string containing machine executable code at the promp...

Stelian Pop dump 0.4 - restore Buffer Overflow

// source: https://www.securityfocus.com/bid/1330/info A buffer overflow exists in the 'restore' program, part of the dump 0.4b15-1 package, distributed with RedHat Linux 6.2. By supplying a long string containing machine executable code at the prompt for a tape name, it is possible for an attack...

CVE-1999-0864

CVE-1999-0864 involves UnixWare programs that dump core; a local user can modify files via a symlink attack on the ./core.pid file. The description notes a local-privilege/impact vector but provides no remediation or explicit exploit details in the supplied documents. The connected documents do n...

CVE-1999-0864

UnixWare programs that dump core allow a local user to modify files via a symlink attack on the ./core.pid file...

swstack.txt

Simple Web Server 0.5.1 bug report ================================== I have recently noticed an interesting bug in Simple Web Server 0.5.1, while browsing around various http daemon codes. apperantly sws uses a small routine that adds your socket input, char by char, into an array of strings see...

CVE-2000-0186

Buffer overflow in the dump utility in the Linux ext2fs backup package allows local users to gain privileges via a long command line argument...

CVE-1999-0076

CVE-1999-0076 describes a buffer overflow in wu-ftp triggered by the PASV command, causing a core dump. The connected documents corroborate the description but do not provide explicit affected versions or a fixed patch. The vulnerability affects wu-ftp and results in process termination (core dum...

CVE-1999-0076

Buffer overflow in wu-ftp from PASV command causes a core dump...

CVE-1999-1293

modproxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core...

SCO Unixware 7.0/7.0.1/7.1/7.1.1 - 'coredump' Symlink

source: https://www.securityfocus.com/bid/851/info Under certain versions of SCO UnixWare if a user can force a program with SGID Set Group ID to dump core they may launch a symlink attack by guessing the PID Process ID of the SGID process which they are calling. This is required because the...

SCO Unixware 7.07.0.17.17.1.1 - coredump Symlink

SCO Unixware 7.07.0.17.17.1.1 - coredump Symlink source: https://www.securityfocus.com/bid/851/info Under certain versions of SCO UnixWare if a user can force a program with SGID Set Group ID to dump core they may launch a symlink attack by guessing the PID Process ID of the SGID process which th...

[SECURITY] New version of dump released.

The version of dump that was distributed with Debian GNU/Linux 2.1 suffers from a problem with restoring symbolic links. This has been fixed in version 0.4b9-0slink1. We recommend you upgrade your dump package immediately. This version "Uses lchown instead of chown, fixing a possible security...

[SECURITY] New version of dump released.

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman December 2, 1999 - ------------------------------------------------------------------------ The version of dump that was...