CVE-2007-1589

TrueCrypt before 4.3, when set-euid mode is used on Linux, allows local users to cause a denial of service filesystem unavailability by dismounting a volume mounted by a different user...

UNIX 7th Edition /bin/mkdir Local Buffer Overflow Exploit

No description provided by source. / Exploit for /bin/mkdir Unix V7 PDP-11. mkdir has a buffer overflow when checking if the directory in /arg/with/slashes/fname exists. This will run /bin/sh with euid 0, but not uid 0. Since the shell doesn't do anything special about this, we don't really care...

BSDi suidperl Local Stack Buffer Overflow Exploit

No description provided by source. / BSDisuidperl buffer overflow, by [email protected]. this is that old buffer overflow in suidperl, but i never saw any version of it for BSDi. so, here it is. this gives euid=0. BSDi/3.0 / define PATH "/usr/bin/suidperl" / path to suidperl on BSDi/3.0. / define...

HP-UX 11i - 'swmodify' Local Stack Overflow / Local Privilege Escalation

/ HP-UX swmodify buffer overflow exploit ======================================= HP-UX 'swmodify' contains an exploitable stack overflow in the handling of command line arguements. Specifically the problem occurs due to insufficent bounds checking in the "-S" optional arguement. 'swmodify' is...

CVE-2004-2012

The CVE-2004-2012 entry concerns the systrace_exit function in the systrace utility used on NetBSD-current (pre-April 16, 2004) and certain FreeBSD ports. The vulnerability arises because the code path does not verify the owner of the /dec/systrace connection before setting the effective user ID ...

GLSA-200502-30 : cmd5checkpw: Local password leak vulnerability

The remote host is affected by the vulnerability described in GLSA-200502-30 cmd5checkpw: Local password leak vulnerability Florian Westphal discovered that cmd5checkpw is installed setuid cmd5checkpw but does not drop privileges before calling execvp, so the invoked program retains the cmd5check...

CVE-2004-0850

CVE-2004-0850 affects the Star archiver. Star versions before 1.5_alpha46 do not drop the effective user ID when invoking the program specified by the RSH environment variable, allowing a local user to gain privileges by referencing a malicious program. The issue is a Suid/root vulnerability with...

UNIX 7th Edition binmkdir - Local Buffer Overflow

UNIX 7th Edition binmkdir - Local Buffer Overflow / Exploit for /bin/mkdir Unix V7 PDP-11. mkdir has a buffer overflow when checking if the directory in /arg/with/slashes/fname exists. This will run /bin/sh with euid 0, but not uid 0. Since the shell doesn't do anything special about this, we don...

SAP database local root via symlink

This local attack upon SAP is based on sapdb-server-linux-32bit-i386-73029.tgz it is currently unknown if this affects other SAP flavors. elguapo@rh8 pgm$ pwd /usr/sapdb/depend/pgm elguapo@rh8 pgm$ ls -al lserver -rwsrwxr-x 1 root sapdb 15673 Oct 22 10:42 lserver Using ltrace we can see an attemp...

QNX

Shouts Zen-parse, lockdown, sloth, ^ChAoS, elfan, Albert E., S. Hawking, Ali G, Jenna Jameson flur, FreeBSD Security Officers, the guy that used to clean our desks every morning and still cleans jaguars desk., QNX developers, Jon Lasser col/67, merlions girlfriend, ourselves and Jenna again. Issu...

Local Vulnerability in dbsnmp binary in Oracle 8.1.6 - 8.1.7 - 9i

WWW.PLAZASITE.COM Systems & Security Division Title: Local Vulnerability in dbsnmp binary Date: 13-07-2001 Platform: Only tested in Linux but can be exported to others. Impact: Users belonging to oracle group can obtain euid=0 Author: Juan Manuel Pascual Escriba [email protected] Status: Vendor...

Проблема символьных линков в LPRng + TeTeX (symbolic link)

Проблема символьных лдинков дает возможность получить euid/egid lp...

Дырка в xconq

Переполнение буфера дает возможность получить euid games...

BSDi SUIDPerl - Local Stack Buffer Overflow

BSDi SUIDPerl - Local Stack Buffer Overflow / BSDisuidperl buffer overflow, by [email protected]. this is that old buffer overflow in suidperl, but i never saw any version of it for BSDi. so, here it is. this gives euid=0. BSDi/3.0 / define PATH "/usr/bin/suidperl" / path to suidperl on BSDi/3.0....

BSDi suidperl Local Stack Buffer Overflow Exploit

Exploit for bsd platform in category local exploits ================================================= BSDi suidperl Local Stack Buffer Overflow Exploit ================================================= / BSDisuidperl buffer overflow, by v9email protected. this is that old buffer overflow in...

Локальная дырка в Oracle 8 (cmctl buffer overflow)

Переполнение буфера в cmctl позволяет получить euid=oracle и egid=dba...

vulnerability in Connection Manager Control binary in Oracle 8.1.5 Linux Platform.

Hello Elias Colud you make public this advisory. Oracle people dont send an answer in 6 days. Please cut this lines. Thanks WWW.PLAZASITE.COM System & Security Division Title: Vulnerability in cmctl in Oracle 8.1.5 Date: 13-11-2000 Platform: Only tested in Linux, but can be exported to others...

vulnerability in Oracle Internet Directory in Oracle 8.1.6

WWW.PLAZASITE.COM System & Security Division Title: Vulnerability in oidldapd in Oracle 8.1.6 Date: 16-10-2000 Platform: Only tested in Linux, but can be exported to others. Impact: Any user gain euid=oracle. Author: Juan Manuel Pascual [email protected] Status: Vendor Contacted but no answers...

Oracle Internet Directory 2.0.6 - oidldap

Oracle Internet Directory 2.0.6 - oidldap // source: https://www.securityfocus.com/bid/1828/info Oracle Internet Directory 2.0.6 is a pre-alpha development release, available as both an addon package and in the Oracle Database Software release 8.1.6. A vulnerability has been found in the oidldap...

Oracle Internet Directory 2.0.6 - oidldap

// source: https://www.securityfocus.com/bid/1828/info Oracle Internet Directory 2.0.6 is a pre-alpha development release, available as both an addon package and in the Oracle Database Software release 8.1.6. A vulnerability has been found in the oidldap binary within the package. A buffer overfl...