Mandrake Linux Security Advisory : smb4k (MDKSA-2005:157)

A severe security issue has been discovered in Smb4K. By linking a simple text file FILE to /tmp/smb4k.tmp or /tmp/sudoers, an attacker could get access to the full contents of the /etc/super.tab or /etc/sudoers file, respectively, because Smb4K didn't check for the existance of these files befor...

Debian DSA-844-1 : mod-auth-shadow - programming error

A vulnerability in modauthshadow, an Apache module that lets users perform HTTP authentication against /etc/shadow, has been discovered. The module runs for all locations that use the 'require group' directive which would bypass access restrictions controlled by another authorisation mechanism,...

USN-184-1: umount vulnerability

David Watson discovered that "umount -r" removed some restrictive mount options like the "nosuid" flag. If /etc/fstab contains user-mountable removable devices which specify the "nosuid" flag which is common practice for such devices, a local attacker could exploit this to execute arbitrary...

CVE-2005-2136

Raritan Dominion SX DSX Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set 1 world-readable permissions for /etc/shadow and 2 world-writable permissions for /bin/busybox, which allows local users to obtain hashed passwords or execute arbitrary code as other users...

CVE-2002-1914

dump 0.4 b10 through b29 allows local users to cause a denial of service execution prevention by using flock to lock the /etc/dumpdates file...

CVE-2002-1914

CVE-2002-1914 concerns the dump utility (versions 0.4 b10 through b29). A local attacker can exploit a faulty flock() lock on /etc/dumpdates to cause a denial of service (execution prevention). Publicly noted references: RHSA-2005:583 and related advisories describe a patch/updates for the dump p...

CVE-2002-1914

dump 0.4 b10 through b29 allows local users to cause a denial of service execution prevention by using flock to lock the /etc/dumpdates file...

USN-142-1: sudo vulnerability

Charles Morris discovered a race condition in sudo which could lead to privilege escalation. If /etc/sudoers allowed a user the execution of selected programs, and this was followed by another line containing the pseudo-command "ALL", that user could execute arbitrary commands with sudo by creati...

USN-114-2: Fixed packages for USN-114-1

USN-114-1 fixed a vulnerability in the PCX decoder of kimgio. Unfortunately it was discovered that the original patches were faulty and caused regressions. This update now has the correct patches. This update also fixes the disappearing KDE settings which were caused by the accidential removal of...

Javamail Multiple Information Disclosure Vulnerabilities

Javamail Multiple Information Disclosure Vulnerabilities May 25, 2005 Yangon, Myanmar. Vulnerable Systems: JavaMail API 1.3 JavaMail API 1.2 JavaMail API 1.1.3 Tested on Apache Tomcat/5.0.16 Possibly on all versions of Windows Failed to restrict to accessing other directory and files in...

RHEL 3 : glibc (RHSA-2005:256)

Updated glibc packages that address several bugs are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The GNU libc packages known as glibc contain the standard C libraries used by applications. It was discovered that the use of LDDEBUG...

ARPUS/Ce Local File Overwrite Exploit (setuid)

Exploit for linux platform in category local exploits ============================================== ARPUS/Ce Local File Overwrite Exploit setuid ============================================== / Copyright Kevin Finisterre - ripped from my perlex.c DISCLAIMER I am in no way responsible for your...

Debian DSA-015-1 : sash - broken maintainer script

Versions of the sash package prior to 3.4-4 did not clone /etc/shadow properly, causing it to be made world-readable. This package only exists in stable, so if you are running unstable you won't see a bugfix unless you use the resources from the bottom of this message to the proper configuration...

linux/x86 chmod 666 /etc/shadow 82 bytes

linux/x86 chmod 666 /etc/shadow 82 bytes. Shellcode exploit for linx86 platform / [email protected] Usando execve y un array de punteros include main char name4; name0="/bin/chmod"; name1="666"; name2="/etc/shadow"; name3=NULL; execvename0,name,NULL; / include char shellcode= "\xeb\x31" /...

linux/x86 add user t00r ENCRYPT 116 bytes

No description provided by source. / !!!!!! ANTI IDS SHELLCODE !!!!!! [email protected] 0x14abril0x7d2 !!!!! ENCRIPTADA !!!!! 116 bytes Agrega la linea "t00r::0:0::/:/bin/sh" en /etc/passwd !!!!! ENCRIPTADA !!!!! Para mas informacion Descargue...

linux/x86 chmod 666 /etc/shadow 41 bytes

No description provided by source. / [email protected] 0x04abril0x7d2 int syschmodconst char filename, modet mode ... Utilizando la interrupcion 15chmod, asignando el octal 0666 al archivo deseado. En este caso /etc/shadow Hice unas modificaciones en el codigo y solo pude reducir la...

linux/x86 chmod 666 /etc/shadow 41 bytes

linux/x86 chmod 666 /etc/shadow 41 bytes. Shellcode exploit for linx86 platform / [email protected] 0x04abril0x7d2 int syschmodconst char filename, modet mode ... Utilizando la interrupcion 15chmod, asignando el octal 0666 al archivo deseado. En este caso /etc/shadow Hice unas...

linux/x86 chmod 666 shadow ENCRYPT 75 bytes

linux/x86 chmod 666 shadow ENCRYPT 75 bytes. Shellcode exploit for linx86 platform / !!!!!! ANTI IDS SHELLCODE !!!!!! [email protected] 0x17abril0x7d2 !!!!! ENCRIPTADA !!!!! 75 bytes chmod 666 /etc/shadow !!!!! ENCRIPTADA !!!!! Para mas informacion Descargue...

linux/x86 chmod 666 shadow ENCRYPT 75 bytes

No description provided by source. / !!!!!! ANTI IDS SHELLCODE !!!!!! [email protected] 0x17abril0x7d2 !!!!! ENCRIPTADA !!!!! 75 bytes chmod 666 /etc/shadow !!!!! ENCRIPTADA !!!!! Para mas informacion Descargue http://www.shellcode.com.ar/Projects/JempiScodesversion.tgz !!!!!! ANTI IDS...

linux/x86 chmod 666 /etc/shadow 41 bytes

Exploit for linux/x86 platform in category shellcode ======================================== linux/x86 chmod 666 /etc/shadow 41 bytes ======================================== / email protected 0x04abril0x7d2 int syschmodconst char filename, modet mode ... Utilizando la interrupcion 15chmod,...