FreeBSD-SA-01:25.kerberosIV

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:25 Security Advisory FreeBSD, Inc. Topic: Local and remote vulnerabilities in Kerberos IV Category: core Module: libkrb, telnetd Announced: 2001-02-14 Credits: Jouko...

CVE-2001-0084

GTK+ library allows local users to specify arbitrary modules via the GTKMODULES environmental variable, which could allow local users to gain privileges if GTK+ is used by a setuid/setgid program...

CVE-2001-0093

Vulnerability in telnetd in FreeBSD 1.5 allows local users to gain root privileges by modifying critical environmental variables that affect the behavior of telnetd...

CVE-2000-1011

Buffer overflow in catopen function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to gain root privileges via a long environmental variable...

CVE-2000-0824

The unsetenv function in glibc 2.1.1 does not properly unset an environmental variable if the variable is provided twice to a program, which could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables such as LDPRELOAD or...

CVE-2000-0959

glibc2 does not properly clear the LDDEBUGOUTPUT and LDDEBUG environmental variables when a program is spawned from a setuid program, which could allow local users to overwrite files via a symlink attack...

CVE-2000-1184

telnetd in FreeBSD 4.2 and earlier, and possibly other operating systems, allows remote attackers to cause a denial of service by specifying an arbitrary large file in the TERMCAP environmental variable, which consumes resources as the server processes the file...

CVE-2000-1163

ghostscript before 5.10-16 uses an empty LDRUNPATH environmental variable to find libraries in the current directory, which could allow local users to execute commands as other users by placing a Trojan horse library into a directory from which another user executes ghostscript...

CVE-2000-1125

restore 0.4b15 and earlier in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the RSH variable to point to a Trojan horse program...

xconq7.4.1 exploit.

i saw some mention of xconq on bugtraq, but no exploit. decided to take a lookie at it...took a little more work than expected to successfully exploitwithout a display, but none-the-less: originalunwarpped/working: http://realhalo.org/xxconq.c xxconq.cwrapped:...

CVE-2000-1125

restore 0.4b15 and earlier in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the RSH variable to point to a Trojan horse program...

CVE-2000-0963

Buffer overflow in ncurses library allows local users to execute arbitrary commands via long environmental information such as TERM or TERMINFODIRS...

CVE-2000-1125

CVE-2000-1125 affects Red Hat Linux 6.2 where the restore utility trusts the pathname in the RSH environment variable. A local attacker can set RSH to a Trojan horse program, potentially gaining root privileges. The vulnerability arises from unvalidated use of RSH in invoking external programs (r...

CVE-2000-0994

Format string vulnerability in OpenBSD fstat program and possibly other BSD-based operating systems allows local users to gain root privileges via the PWD environmental variable...

CVE-2000-1013

The setlocale function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable...

CVE-2000-1012

The catopen function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable...

CVE-2000-1012

FreeBSD 5.0 and earlier are affected by CVE-2000-1012 due to the catopen function reading files via the LANG environment variable. Local users can read arbitrary files, yielding complete confidentiality and integrity impacts as described in the NVD entry (AV:L/AC:L/Au:N/C:C/I:C/A:C). The vulnerab...

CVE-2000-1013

The CVE-2000-1013 entry describes a local file read vulnerability in setlocale affecting FreeBSD/5.0 and earlier (and possibly other OSes), where an attacker can read arbitrary files via the LANG environment variable. The NVD entry lists a base CVSS v2 score of 7.2 (HIGH) with local access, low a...

CVE-2000-1013

The setlocale function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable...

CVE-2000-0824

The unsetenv function in glibc 2.1.1 does not properly unset an environmental variable if the variable is provided twice to a program, which could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables such as LDPRELOAD or...