CVE-2001-1467: Undefined Security Weakness

mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks...

Mandrake Linux Security Advisory : tcltk (MDKSA-2002:060)

Some problems were discovered with the Tcl/Tk development environment. The expect application would search for its libraries in /var/tmp prior to searching in other directories, which could allow a local user to gain root privilege by writing a trojan library and waiting for the root user to run...

Mandrake Linux Security Advisory : expect (MDKSA-2001:087)

A packaging problem that can lead to a root compromise existed in the expect package as provided in Mandrake Linux 8.1. expect would look for libraries in the directory /home/snailtalk/tmp/tcltk-root/usr/lib before any other and if such a user existed on the system, with rogue libraries, if root...

CVE-2001-1374

Summary (concrete details from connected documents): The vulnerability is in the expect utility prior to version 5.32, where it searches for its libraries in /var/tmp before other directories. A local attacker could exploit this by placing a Trojan horse library that mkpasswd would load, potentia...

CVE-2001-1374: Undefined Security Weakness

expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges via a Trojan horse library that is accessed by mkpasswd...

CVE-2001-0912

Packaging error for expect 8.3.3 in Mandrake Linux 8.1 causes expect to search for its libraries in the /home/snailtalk directory before other directories, which could allow a local user to gain root privileges...

CVE-2001-0912

CVE-2001-0912 affects Mandrake Linux 8.1 in the expect package (8.3.3). A packaging flaw causes expect to search libraries in /home/snailtalk before other directories, enabling a local user to gain root privileges. Mandrake issued MDKSA-2001:087 to address this.

CVE-2001-0912: Undefined Security Weakness

Packaging error for expect 8.3.3 in Mandrake Linux 8.1 causes expect to search for its libraries in the /home/snailtalk directory before other directories, which could allow a local user to gain root privileges...

CVE-2001-0912

Packaging error for expect 8.3.3 in Mandrake Linux 8.1 causes expect to search for its libraries in the /home/snailtalk directory before other directories, which could allow a local user to gain root privileges...

expect to get hacked

====================== expect to get hacked ====================== After looking at a recent discussion on vuln-dev, I decided that this might as well be released again. Makes the process of exploiting expect a little rpm -qf which expect expect-5.31-46 Under Redhat 7.0 expect uses the wrong path...

ssh-brute.sh

!/usr/bin/expect -f simple expect exploit to brute force root's password via ssh without detection.. see CLABS200101 for info on this exploit. this is beerware, just buy me a beer at defcon if you like this. build your own dictionary, use at your own risk, no warranty, etc. [email protected]...

hhp-expect_adv0017.txt

------------------------------------------------------------------------------- hhp adv-17 Sec-Advisory/Exploit/Patch www.hhp-programming.net ------------------------------------------------------------------------------- Topic: Expect. Versions: 5.31.8 and 5.28.1, maybe others. Date: 12/12/2000...

hhp's Expect advisory/exploit/patch.

------------------------------------------------------------------------------- hhp adv-17 Sec-Advisory/Exploit/Patch www.hhp-programming.net ------------------------------------------------------------------------------- Topic: Expect. Versions: 5.31.8 and 5.28.1, maybe others. Date: 12/12/2000...

expect (/usr/bin/expect) buffer overflow

Exploit for linux platform in category local exploits ======================================== expect /usr/bin/expect buffer overflow ======================================== / hhp-expectsmash.c 12/11/00 expect /usr/bin/expect buffer overflow. Tested 5.31.8 and 5.28.1, slackware 7.x Maybe others...

expect (usrbinexpect) - Local Buffer Overflow

expect usrbinexpect - Local Buffer Overflow / hhp-expectsmash.c 12/11/00 expect /usr/bin/expect buffer overflow. Tested 5.31.8 and 5.28.1, slackware 7.x Maybe others. By: isox Site: www.hhp-programming.net Advisory: www.hhp-programming.net/ouradvisories/hhp-expectadv%2317.txt / include include...

expect (/usr/bin/expect) - Local Buffer Overflow

/ hhp-expectsmash.c 12/11/00 expect /usr/bin/expect buffer overflow. Tested 5.31.8 and 5.28.1, slackware 7.x Maybe others. By: isox Site: www.hhp-programming.net Advisory: www.hhp-programming.net/ouradvisories/hhp-expectadv%2317.txt / include include define NOP 0x90 define OFFSET 0 define BUFLEN...