PT-2010-4779

Name of the Vulnerable Software and Affected Versions TeamSpeak versions 2.0.32 Description The issue allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is due to the teamspeak and teamspeak-server scripts placing a zero-length directory...

PT-2010-4767

Name of the Vulnerable Software and Affected Versions VIPS version 7.22.2 Description The issue allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is due to the vips-7.22 script placing a zero-length directory name in the LD LIBRARY PATH...

PT-2010-4774

Name of the Vulnerable Software and Affected Versions SALOME version 5.1.3 Description The issue allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is due to the runSalome, runTestMedCorba, runLightSalome, and hxx2salome scripts placing ...

PT-2010-4775

Name of the Vulnerable Software and Affected Versions Scilab version 5.2.2 Description The issue allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is due to the scilab, scilab-cli, and scilab-adv-cli scripts placing a zero-length...

PT-2010-4768

Name of the Vulnerable Software and Affected Versions Mistelix version 0.31 Description The issue allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is possible because Mistelix 0.31 places a zero-length directory name in the LD LIBRARY...

PT-2010-4778

Name of the Vulnerable Software and Affected Versions Tuning and Analysis Utilities TAU version 2.16.4 Description The issue allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is due to tauex in Tuning and Analysis Utilities TAU placing ...

PT-2010-4758

Name of the Vulnerable Software and Affected Versions Cowbell version 0.2.7.1 Description The issue allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is due to Cowbell placing a zero-length directory name in the LD LIBRARY PATH...

PT-2010-4780

Name of the Vulnerable Software and Affected Versions TORCS version 1.3.1 Description The issue allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is due to the torcs, nfsperf, accc, texmapper, trackgen, and nfs2ac scripts in TORCS placi...

PT-2010-4781

Name of the Vulnerable Software and Affected Versions TuxGuitar version 1.2 Description The issue allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is due to TuxGuitar placing a zero-length directory name in the LD LIBRARY PATH...

PT-2010-4757

Name of the Vulnerable Software and Affected Versions startBristol version 0.60.5 Description The issue allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is due to a zero-length directory name being placed in the LD LIBRARY PATH...

UBUNTU-CVE-2010-3380

The 1 init.d/slurm and 2 init.d/slurmdbd scripts in SLURM before 2.1.14 place the . dot directory in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

PT-2010-4776

Name of the Vulnerable Software and Affected Versions SLURM versions prior to 2.1.14 Description The issue allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is due to the init.d/slurm and init.d/slurmdbd scripts placing the . dot...

FreeBSD Security Advisory (FreeBSD-SA-09:16.rtld.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-09:16.rtld.asc SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

FreeBSD ld-elf本地权限提升漏洞

FreeBSD是一款开放源代码的基于BSD的操作系统。 在ld-elf对环境变量处理存在本地权限提升漏洞 FreeBSD包含的Run-Time Link-Editor rtld存在问题，本地攻击者可以利用漏洞获得root特权。 一般情况下，在执行类似"ping"或"su" setugid的程序时，RTLD不允许设置类似LDPRELOAD这类的危险环境变量，不过存在漏洞可让rtld被诱使在setugid程序上接收LD变量，导致特权提升。 FreeBSD 8.0-RELEASE FreeBSD 7.1-RELEASE 厂商解决方案 目前没有解决方案提供：...

Ordinary users by udev vulnerability to elevate to root permissions demo-vulnerability warning-the black bar safety net

Recently exposed by the udev permissions hint of vulnerability, as long as with normal user permissions, you can elevate to root privileges, the experiment a handful, really easy to upgrade. Put the following code saved as test. sh file !/ bin/sh Linux 2.6 bug found by Sebastian Krahmer lame splo...

Linux Kernel 2.6 UDEV Local Privilege Escalation Exploit

No description provided by source. !/bin/sh Linux 2.6 bug found by Sebastian Krahmer lame sploit using LD technique by kcope in 2009 tested on debian-etch,ubuntu,gentoo do a 'cat /proc/net/netlink' and set the first arg to this script to the pid of the netlink socket the pid is udevdpid - 1 most ...

Linux Kernel 2.6 UDEV Local Privilege Escalation Exploit

Exploit for linux platform in category local exploits ======================================================== Linux Kernel 2.6 UDEV Local Privilege Escalation Exploit ======================================================== !/bin/sh Linux 2.6 bug found by Sebastian Krahmer lame sploit using LD...

Linux 2.6 Kernel UDEV Exploit

!/bin/sh Linux 2.6 bug found by Sebastian Krahmer lame sploit using LD technique by kcope in 2009 tested on debian-etch,ubuntu,gentoo do a 'cat /proc/net/netlink' and set the first arg to this script to the pid of the netlink socket the pid is udevdpid - 1 most of the time + sploit has to be UNIX...

DEBIAN-CVE-2009-0415

Untrusted search path vulnerability in trickle 1.07 allows local users to execute arbitrary code via a Trojan horse trickle-overload.so in the current working directory, which is referenced in the LDPRELOAD path...

Solaris Runtime Linker (ld.so.1) Buffer Overflow Exploit (SPARC version

No description provided by source. / ld.so.1 exploit SPARC coded by: osker178 bjr213 psu.edu Alright, so this exploits a fairly standard buffer overflow in the default Solaris runtime linker ld.so.1 discovery by Jouko Pynnonen Only real deviation here from the standard overflow and return into li...