[Full-disclosure] [SECURITY] [DSA 1040-1] New gdm packages fix local root exploit

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1040-1 [email protected] http://www.debian.org/security/ Martin Schulze April 24th, 2006 http://www.debian.org/security/faq -...

Microsoft Windows - keybd_event Local Privilege Escalation

Microsoft Windows - keybdevent Local Privilege Escalation / Microsoft Windows keybdevent validation vulnerability. Local privilege elevation Credits: Andres Tarasco aT4r @ haxorcitos.com Iñaki Lopez ilo @ reversing.org Platforms afected/tested: - Windows 2000 - Windows XP - Windows 2003 Original...

CVE-2005-1816

Invision Power Board IPB 1.0 through 2.0.4 allows non-root admins to add themselves or other users to the root admin group via the "Move users in this group to" screen...

Linux Kernel 2.4 - SUID 'execve()' System Call Race Condition Executable File Read

/ source: https://www.securityfocus.com/bid/8042/info A race condition vulnerability has been discovered in the Linux execve system call, affecting the 2.4 kernel tree. The problem lies in the atomicity of placing a target executables file descriptor within the current process descriptor and...

MS02-014: Unchecked buffer in Windows Shell (313829)

The Windows shell of the remote host has an unchecked buffer that can be exploited by a local attacker to run arbitrary code on this host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11307; scriptversion"1.36"; scriptcvsdate"Date: 2018/11/15 20:50:29";...

HP Tru64 - NLSPATH Environment Variable Local Buffer Overflow (2)

HP Tru64 - NLSPATH Environment Variable Local Buffer Overflow 2 source: https://www.securityfocus.com/bid/5647/info Tru64 is a commercially available UNIX operating system. Tru64 was originally developed by Digital and is now distributed and maintained by HP. A buffer overflow has been discovered...

CVE-2002-0740

Buffer overflow in slrnpull for the SLRN package, when installed setuid or setgid, allows local users to gain privileges via a long -d SPOOLDIR argument...

HP Tru64 - NLSPATH Environment Variable Local Buffer Overflow (1)

source: https://www.securityfocus.com/bid/5647/info Tru64 is a commercially available UNIX operating system. Tru64 was originally developed by Digital and is now distributed and maintained by HP. A buffer overflow has been discovered in a number of Tru64 binaries. Attackers may exploit this via a...

SRT Security Advisory (SRT2002-06-04-1711): SCO crontab

====================================================================== Strategic Reconnaissance Team Security Advisory SRT2002-06-04-1611 Topic : SCO OpenServer crontab format string vulnerability Date : June 04, 2002 Credit : KF dotslashatsnosoft.com Site : http://www.snosoft.com...

MS02-024: Windows Debugger flaw can Lead to Elevated Privileges (320206)

The remote host contains a flaw in the Windows Debugger that could allow a local user to elevate his privileges. To exploit this vulnerability, a user needs to send a specially crafted code to the Debbuging handler to execute arbitrary code with SYSTEM privileges. %NASLMINLEVEL 70300 C Tenable...

Tarantella Enterprise 3 - Symbolic Link

Tarantella Enterprise 3 - Symbolic Link source: https://www.securityfocus.com/bid/4115/info Tarantella Enterprise 3 contains a locally exploitable symbolic link vulnerability during it's installation procedure. This vulnerability can be exploited to elevate privileges. An attacker anticipating th...

Linux kernel contains race condition via ptrace/procfs/execve

Overview Unprivileged local users can use the ptrace function to take advantage of a privileged program, while that program is performing a privileged operation, to gain privileged access. Description Ptrace is a function, which is often used for debugging, that allows one process to attach to...

Solaris 8 libsldap - Local Buffer Overflow (2)

Solaris 8 libsldap - Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/2931/info Solaris 8 ships with a shared library that implements LDAP functionality called 'libsldap'. This library is linked to by a number of system utilities, many of them installed setuid or setgid...

ISC INN 2.x - Command-Line Buffer Overflow (2)

source: https://www.securityfocus.com/bid/2620/info The innfeed utility, part of ISC InterNetNews, has an exploitable buffer overflow in its command-line parser. Specifically, innfeed will overflow if an overly long -c option is passed to it. A local attacker in the news group could use this...

ISC INN 2.x - Command-Line Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/2620/info The innfeed utility, part of ISC InterNetNews, has an exploitable buffer overflow in its command-line parser. Specifically, innfeed will overflow if an overly long -c option is passed to it. A local attacker in the news group could use this...

Debian 2.2 Su.S.E 6.36.47.0 - man -l Format String

Debian 2.2 Su.S.E 6.36.47.0 - man -l Format String source: https://www.securityfocus.com/bid/2327/info man is the manual page viewing program, available with the Linux Operating System in this implementation. It is freely distributed and openly maintained. A problem with the man command may allow...

HP-UX 10.2011.0 - .SNMPD File Permission

HP-UX 10.2011.0 - .SNMPD File Permission source: https://www.securityfocus.com/bid/1327/info A vulnerability exists in the snmpd included with HPUX 11, from Hewlett Packard. The configuration file for the snmpd is world writable. This could allow any user on the system to view and/or alter the...