Path traversal

The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable...

CVE-2010-1646

CVE-2010-1646 affects the sudo secure_path behavior when an environment contains multiple PATH variables, allowing local privilege escalation. Impact, as described in connected advisories, covers multiple sudo versions: 1.3.1–1.6.9p22 and 1.7.0–1.7.2p6. The root cause is insufficient sanitization...

McAfee Email Gateway (formerly IronMail) - Local Privilege Escalation

McAfee Email Gateway formerly IronMail - Local Privilege Escalation Advisory Name: Local Privilege Escalation in McAfee Email Gateway formerly IronMail Vulnerability Class: Local Privilege Escalation Release Date: Tue Apr 6, 2010 Affected Applications: Secure Mail Ironmail ver.6.7.1 Affected...

FreeBSD privilege escalation

It's possible to bypass environment variables filtering on suid program execution...

CVE-2009-4147

The rtld function in the Run-Time Link-Editor rtld in libexec/rtld-elf/rtld.c in FreeBSD 7.1 and 8.0 does not clear the 1 LDLIBMAP, 2 LDLIBRARYPATH, 3 LDLIBMAPDISABLE, 4 LDDEBUG, and 5 LDELFHINTSPATH environment variables, which allows local users to gain privileges by executing a setuid or setgu...

EUVD-2009-4117

The rtld function in the Run-Time Link-Editor rtld in libexec/rtld-elf/rtld.c in FreeBSD 7.1 and 8.0 does not clear the 1 LDLIBMAP, 2 LDLIBRARYPATH, 3 LDLIBMAPDISABLE, 4 LDDEBUG, and 5 LDELFHINTSPATH environment variables, which allows local users to gain privileges by executing a setuid or setgu...

CVE-2009-4147

CVE-2009-4147 affects FreeBSD rtld (libexec/rtld-elf/rtld.c) on FreeBSD 7.1, 7.2 and 8.0. The rtld function fails to clear LD * environment variables, allowing a local user to exploit a modified search path to load a Trojan library and escalate privileges (e.g., through setuid/setgid programs). R...

PHP 5.3.x < 5.3.1 Multiple Vulnerabilities

Binary data 801090.prm...

SuSE9 Security Update : telnet (YOU Patch Number 10238)

The telnet client protocol can be abused by a malicious server to read the environment of the client site. The information can be used as preparation for further attacks. This bug can also be exploited by using the telnet:// URL on a web-site and letting the web-browser fork a telnet client. This...

IBM AIX 5.66.1 - _LIB_INIT_DBG Arbitrary File Overwrite via Libc Debug

IBM AIX 5.66.1 - LIBINITDBG Arbitrary File Overwrite via Libc Debug !/bin/sh $Id: raptorlibC,v 1.1 2009/09/10 15:08:04 raptor Exp $ raptorlibC - AIX arbitrary file overwrite via libC debug Copyright c 2009 Marco Ivaldi Property of @ Mediaservice.net Srl Data Security Division...

Explain how to provide the right to the use of environment variables-vulnerability and early warning-the black bar safety net

First, we first understand under what environment variables! Environment variable generally refers to in theoperating systemis used to specify theoperating systemthe operating environment of some parameters, such as the temporary folder location and system folder locations, and so on. This point ...

iDefense Security Advisory 08.06.09: IBM AIX libC _LIB_INIT_DBG Arbitrary File Creation Vulnerability

iDefense Security Advisory 08.04.09 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 04, 2009 I. BACKGROUND IBM's AIX is a Unix operating system based on System V, which runs on the PowerPC PPC architecture. For more information, visit the product web site at the following URL...

IBM AIX libc privilege escalation

It's possible to maniuplate files via LIBINITDBG and LIBINITDBGFILE environment variables for suid applications...

CVE-2009-2669: Undefined Security Weakness

A certain debugging component in IBM AIX 5.3 and 6.1 does not properly handle the 1 LIBINITDBG and 2 LIBINITDBGFILE environment variables, which allows local users to gain privileges by leveraging a setuid-root program to create an arbitrary root-owned file with world-writable permissions, relate...

IBM AIX 5.3 libc MALLOCDEBUG File Overwrite Vulnerability

No description provided by source. !/bin/bash \ / /| | | | \ | | | | | | \ | | | | | | \ \ | | \ | | | | \ | | \ \ | | | \ | |/ / |/ http://root-the.net + IBM AIX libc MALLOCDEBUG File Overwrite Vulnerability + Refer : securitytracker.com/id?1022261 + Exploit : Affix [email protected] + Tested on...

IBM AIX 5.3 libc MALLOCDEBUG File Overwrite Vulnerability

Exploit for aix platform in category local exploits ========================================================= IBM AIX 5.3 libc MALLOCDEBUG File Overwrite Vulnerability ========================================================= !/bin/bash + IBM AIX libc MALLOCDEBUG File Overwrite Vulnerability +...

IBM AIX 5.3 - libc MALLOCDEBUG File Overwrite

IBM AIX 5.3 - libc MALLOCDEBUG File Overwrite !/bin/bash \ / /| | | | \ | | | | | | \ | | | | | | \ \ | | \ | | | | \ | | \ \ | | | \ | |/ / |/ http://root-the.net + IBM AIX libc MALLOCDEBUG File Overwrite Vulnerability + Refer : securitytracker.com/id?1022261 + Exploit : Affix + Tested on : IBM...

IBM AIX 5.3 - 'libc' MALLOCDEBUG File Overwrite

!/bin/bash \ / /| | | | \ | | | | | | \ | | | | | | \ \ | | \ | | | | \ | | \ \ | | | \ | |/ / |/ http://root-the.net + IBM AIX libc MALLOCDEBUG File Overwrite Vulnerability + Refer : securitytracker.com/id?1022261 + Exploit : Affix + Tested on : IBM AIX + Greetz : Mad-Hatter, Atomiku, RTN,...

Hitachi Web Server Vulnerability in SSL Client Authentication

Overview Hitachi Web Server contains a vulnerability in handling SSL client certificates, which could allow an attacker to manipulate environment variables and/or spoof the client to access Web servers. Impact An attacker could manipulate environment variables and/or spoof the client to access We...

CVE-2003-1572

Sun Java Media Framework JMF 2.1.1 through 2.1.1c allows unsigned applets to cause a denial of service JVM crash and read or write unauthorized memory locations via the ReadEnv class, as demonstrated by reading environment variables using modified .data and .size fields...