Redhat Linux 6.x remote root exploit

Hi, Included below is an exploit for the recently exposed linux rpc.statd format string vulnerability0. I have tailored it towards current Redhat Linux 6.x installations. It can easily be incorporated into attacks against the other vulnerable Linux distributions. I am not a security expert, but...

Redhat Linux 6.x remote root exploit

Hi, Included below is an exploit for the recently exposed linux rpc.statd format string vulnerability0. I have tailored it towards current Redhat Linux 6.x installations. It can easily be incorporated into attacks against the other vulnerable Linux distributions. I am not a security expert, but...

HPUX FTPd vulnerability

Hello, I have discovered HPUX ftpd remote vulnerability. The problem persists in using vsprintf without format string. Example: 220 xxx FTP server Version 1.7.212.2 Tue Apr 21 12:14:46 GMT 1998 ready. user ftp 331 Guest login ok, send ident as password. pass .1030d 230 Guest login ok, access...

Дырка в HP-UX FTPd

Переполнение буфера в результате ошибки форматной строки команда PASS...

Conectiva 4.x5.x Debian 2.x RedHat 6.x S.u.S.E 6.x7.0 Trustix 1.x - rpc.statd Remote Format String (3)

Conectiva 4.x5.x Debian 2.x RedHat 6.x S.u.S.E 6.x7.0 Trustix 1.x - rpc.statd Remote Format String 3 // source: https://www.securityfocus.com/bid/1480/info A vulnerability exists in the 'rpc.statd' program, which is part of the 'nfs-utils' package that is shipped with a number of popular Linux...

Conectiva 4.x/5.x / Debian 2.x / RedHat 6.x / S.u.S.E 6.x/7.0 / Trustix 1.x - rpc.statd Remote Format String (3)

// source: https://www.securityfocus.com/bid/1480/info A vulnerability exists in the 'rpc.statd' program, which is part of the 'nfs-utils' package that is shipped with a number of popular Linux distributions. Because of a format-string vulnerability when calling the 'syslog' function, a remote...

NAI Net Tools PKI Server 1.0 - Format String

source: https://www.securityfocus.com/bid/1538/info Certain versions of Network Associates Inc.'s Net Tools PKI Public Key Infrastructure server ship with a vulnerability which allows remote attackers to execute arbitrary commands on the system which the PKI server resides. The problem lies withi...

Lots and lots of fun with rpc.statd

Last week was a little quiet, so I thought I'd throw some kindling on the fire. Here's another prime example of a format string bug: our old friend rpc.statd. Attached is an exploit. The offsets are for Linux/PowerPC, Debian 2.2. It isn't functional, though - and it's more than just kiddy-proofed...

Conectiva 4.x5.x Debian 2.x RedHat 6.x S.u.S.E 6.x7.0 Trustix 1.x - rpc.statd Remote Format String (1)

Conectiva 4.x5.x Debian 2.x RedHat 6.x S.u.S.E 6.x7.0 Trustix 1.x - rpc.statd Remote Format String 1 // source: https://www.securityfocus.com/bid/1480/info A vulnerability exists in the 'rpc.statd' program, which is part of the 'nfs-utils' package that is shipped with a number of popular Linux...

Conectiva 4.x/5.x / Debian 2.x / RedHat 6.x / S.u.S.E 6.x/7.0 / Trustix 1.x - rpc.statd Remote Format String (1)

// source: https://www.securityfocus.com/bid/1480/info A vulnerability exists in the 'rpc.statd' program, which is part of the 'nfs-utils' package that is shipped with a number of popular Linux distributions. Because of a format-string vulnerability when calling the 'syslog' function, a remote...

CVE-2000-0573

The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command...

Удаленный root в proftpd

Дырка похожая на аналогичную в WU, связана с использованием ввода пользователя в качестве форматной строки...

Удаленный root через ftpd в OpenBSD

Ошибка "форматной строки" полностью аналогичная ошибке в wu-ftpd...

BitchX IRC Client 75p1/75p3/1.0 c16 - '/INVITE' Format String

// source: https://www.securityfocus.com/bid/1436/info BitchX IRC clients, versions 75 up to and including 1.0c16, are vulnerable to a Denial of Service and possible remote execution of code. By /invite-ing someone to a channel name containing formatting characters %s, %n, etc an IRC user can cau...

BitchX IRC Client 75p175p31.0 c16 - INVITE Format String

BitchX IRC Client 75p175p31.0 c16 - INVITE Format String // source: https://www.securityfocus.com/bid/1436/info BitchX IRC clients, versions 75 up to and including 1.0c16, are vulnerable to a Denial of Service and possible remote execution of code. By /invite-ing someone to a channel name...

CVE-2000-0594

BitchX IRC client does not properly cleanse an untrusted format string, which allows remote attackers to cause a denial of service via an invite to a channel whose name includes special formatting characters...

ftpd: the advisory version

You might have seen the wuftpd exploit by tf8, he released it in his own lame way. But now I bring you the story behind it. The story begins inside the ftpcmd.y file. Which has the ftp commands in it. The bug is in the siteexecchar cmd function. There is calls lreply200,cmd; In ftpd.c we find voi...

qpopper format string vulnerability

An authenticated user may trigger a format string vulnerability present in qpopper's UIDL code, resulting in arbitrary code execution with group ID mail' privileges...

WU-FTPD 2.4.2/2.5 .0/2.6.0 - Remote Format String Stack Overwrite (1)

// source: https://www.securityfocus.com/bid/1387/info Washington University ftp daemon wu-ftpd is a very popular unix ftp server shipped with many distributions of Linux and other UNIX operating systems. Wu-ftpd is vulnerable to a very serious remote attack in the SITE EXEC implementation. Becau...

WU-FTPD 2.4.22.5 .02.6.0 - Remote Format String Stack Overwrite (1)

WU-FTPD 2.4.22.5 .02.6.0 - Remote Format String Stack Overwrite 1 // source: https://www.securityfocus.com/bid/1387/info Washington University ftp daemon wu-ftpd is a very popular unix ftp server shipped with many distributions of Linux and other UNIX operating systems. Wu-ftpd is vulnerable to a...