Solaris 7/8 - 'kcms_configure' Command-Line Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/2558/info The Kodak Color Management System, or KCMS, is a package that ships with workstation installations of Solaris 7 and 8. kcmsconfigure, a part of KCMS, is vulnerable to a buffer overflow if it is passed an overly long string on the command-line...

DGUX 4.20 lpsched - Error Message Local Buffer Overflow

DGUX 4.20 lpsched - Error Message Local Buffer Overflow // source: https://www.securityfocus.com/bid/2509/info DGUX is the Data General revision of UNIX. It is designed as a solution for Intel systems produced by Data General. A problem in the handling of error messages by the printer scheduler...

FreeBSD-SA-01:23.icecast

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:23 Security Advisory FreeBSD, Inc. Topic: icecast port contains remote vulnerability Category: ports Module: icecast Announced: 2001-03-12 Credits: |CyRaX| Affects: Ports...

PALS Library System WebPALS 1.0 - pals-cgi Traversal Arbitrary File Read

PALS Library System WebPALS 1.0 - pals-cgi Traversal Arbitrary File Read source: https://www.securityfocus.com/bid/2372/info A specially crafted URL composed of a known filename, will disclose the requested file residing on a machine running WebPALS. This vulnerability will also allow an attacker...

Solaris 7.08 - Xsun Buffer Overrun

Solaris 7.08 - Xsun Buffer Overrun // source: https://www.securityfocus.com/bid/1140/info A buffer overrun vulnerability exists in the Xsun X11 server, as shipped as part of Solaris 7 and 8 from Sun Microsystems. By supplying a long argument to the -dev option normally used to set the output...

Solaris 2.67.0 - lp -d Option Buffer Overflow

Solaris 2.67.0 - lp -d Option Buffer Overflow // source: https://www.securityfocus.com/bid/1143/info A buffer overrun has been discovered in the lp program, as included with Sun's Solaris 7 operating system. By passing well crafted, machine executable code of sufficient length to the -d option of...

SCO_root_exploit.txt

Greetings, A vulnerability exists in the /usr/lib/merge/dos7utils program suid root by default which allows any user to execute any command as root. The dos7utils program gets its localeset.sh exec path from the environment variable STATICMERGE. By setting this to a directory writable by us and...

cfingerd_bug.txt

Subject: Severe bug in cfingerd before 1.4.0 To: [email protected] Severe bug in cfingerd before 1.ems Content-Type: text/plain; charset=us-ascii PGP Signature Status: unknown Signer: Unknown, Key ID xAE8F7CF5 Signed: 8/10/99 11:34:37 AM Verified: 9/21/99 7:41:23 PM BEGIN PGP VERIFIED...

Solaris 2.5/2.5.1/2.6/7.0 - 'sadmind' Remote Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/866/info Certain versions of Solaris ship with a version of sadmind which is vulnerable to a remotely exploitable buffer overflow attack. sadmind is the daemon used by Solstice AdminSuite applications to perform distributed system administration...

Solaris 2.67.08 - netpr Local Buffer Overflow (1)

Solaris 2.67.08 - netpr Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/1200/info A buffer overrun exists in the 'netpr' program, part of the SUNWpcu LP package included with Solaris, from Sun Microsystems. Versions of netpr on Solaris 2.6 and 7, on both Sparc and x86 have be...

Solaris 2.6/7.0/8 - 'netpr' Local Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/1200/info A buffer overrun exists in the 'netpr' program, part of the SUNWpcu LP package included with Solaris, from Sun Microsystems. Versions of netpr on Solaris 2.6 and 7, on both Sparc and x86 have been confirmed as being vulnerable. The overflow i...

HP-UX 10/11/ IRIX 3/4/5/6 / OpenSolaris build snv / Solaris 8/9/10 / SunOS 4.1 - 'rpc.ypupdated' Command Execution (1)

/ source: https://www.securityfocus.com/bid/1749/info HP-UX 10.x/11.x,IRIX 3.x/4.x/5.x/6.x,OpenSolaris build snv,Solaris 8/9/10,SunOS 4.1.x RPC.YPUpdated Command Execution 1 The 'rpc.ypupdated' deamon is part of the Network Information Service NIS or Yellow Pages YP. It allows clients to update N...