CVE-2000-0159

CVE-2000-0159 affects HP Ignite-UX. The issue: when imaging a trusted system, Ignite-UX does not save /etc/passwd, which can leave the password field blank and enable privilege escalation. The description and connected documents confirm the vulnerable component and the underlying behavior, but do...

CVE-2000-0159

HP Ignite-UX does not save /etc/passwd when it creates an image of a trusted system, which can set the password field to a blank and allow an attacker to gain privileges...

CVE-1999-0712

CVE-1999-0712 affects Caldera Open Administration System (COAS). The vulnerability allows the /etc/shadow password file to be made world-readable, indicating a confidentiality impact. Exploitation details are not provided in the connected documents; sources (Red Hat, CVE entries, and PT Security)...

CVE-1999-0515

CVE-1999-0515 relates to an unrestricted remote trust relationship in Unix/Linux environments (eg, using + in /etc/hosts.equiv/.rhosts via rsh). Root access can be gained if a trusted host is compromised. Remediation described in sources: remove the wildcard (+) from /etc/hosts.equiv and the root...

SCO Unixware 7.1 pkginstall - Local Buffer Overflow

SCO Unixware 7.1 pkginstall - Local Buffer Overflow // source: https://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are...

unixware.pkg.exploits.txt

Greetings, OVERVIEW Most of UnixWare's pkg commands can be exploited to print /etc/shadow, leading to a probable root compromise. BACKGROUND Only tested on UnixWare 7.1. DETAILS The permissions for the UnixWare pkg commands are as follows: bash-2.02$ ls -la /usr/sbin/pkgchk /usr/bin/pkginfo...

unixware.pkg.txt

Greetings, OVERVIEW Any user may read any file on the system. BACKGROUND Only UnixWare 7.1 has been tested. DETAILS As previously stated, UnixWare binaries gain additional privileges via standard suid/sgid AND /etc/security/tcb/privs. The majority of the UnixWare "pkg" command, such as pkginfo,...

SCO Unixware 7.1 pkgcat - Local Buffer Overflow

SCO Unixware 7.1 pkgcat - Local Buffer Overflow // source: https://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are...

SCO Unixware 7.1 pkgcat - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are granted in /etc/security/tcb/privs give them the...

SCO Unixware 7.1 pkginstall - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are granted in /etc/security/tcb/privs give them the...

pam_unix_passwd.so.txt

Date: Wed, 23 Dec 1998 13:12:45 +0100 From: Michal Zalewski Reply-To: Bugtraq List To: [email protected] Subject: Linux PAM up to 0.64-2 local root compromise As someone said, "Never make any mistaeks." Latest release of Linux Pluggable Authentication Modules pam-0.64-2, as well as previous...

CVE-1999-0515

An unrestricted remote trust relationship for Unix systems has been set up, e.g. by using a + sign in /etc/hosts.equiv...

Slackware Linux 3.5 - etcgroup Local Privilege Escalation

Slackware Linux 3.5 - etcgroup Local Privilege Escalation source: https://www.securityfocus.com/bid/155/info Due to the way /bin/login behaves when a /etc/group file is not present under Slackware's version of the password shadowing suite, users who log in while this file is not present will be...

Slackware Linux 3.5 - '/etc/group' Local Privilege Escalation

source: https://www.securityfocus.com/bid/155/info Due to the way /bin/login behaves when a /etc/group file is not present under Slackware's version of the password shadowing suite, users who log in while this file is not present will be given uid and gid 0. This will allow them unrestricted acce...

SunOS 4.1.3 - '/etc/crash' SetGID kmem Privilege Escalation

source: https://www.securityfocus.com/bid/59/info /etc/crash was installed setgid kmem and excutable by anyone. Any user can use the ! shell command escape to executes commands, which are then performed with group set to kmem. $ /etc/crash ! sh...