170 matches found
Izik : Reverse Engineering with LD_PRELOAD
July, 06 2005г.| Izik Reverse Engineering with LDPRELOAD This paper is about the LDPRELOAD feature, and how it can be useful for reverse engineering dynamically linked executables. This technique allows you to hijack functions/inject code and manipulate the application flow. Compiling Methods...
CVE-2006-6164
The dlunsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LDPRELOAD to loading processes, which might be leveraged to gain privileges...
CVE-2006-6164
The dlunsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LDPRELOAD to loading processes, which might be leveraged to gain privileges...
CVE-2006-6164
The CVE-2006-6164 entry concerns OpenBSD 3.9 and 4.0 where the _dl_unsetenv function in loader.c of the ELF ld.so fails to remove duplicate environment variables. This could allow local users to pass dangerous variables (e.g., LD_PRELOAD) to loading processes, potentially enabling privilege escal...
GLIBC 2.1.3 ld_preload Local Exploit
No description provided by source. !/bin/tcsh przyklad wykorzystania dziury w LDPRELOAD shadow tested on redhat 6.0, should work on others if -e /etc/initscript echo uwaga: /etc/initscript istnieje cd /lib umask 0 setenv LDPRELOAD libSegFault.so setenv SEGFAULTOUTPUTNAME /etc/initscript echo...
Solaris 10 libnspr LD_PRELOAD Arbitrary File Creation Local Root Exploit
No description provided by source. !/bin/sh $Id: raptorlibnspr2,v 1.4 2006/10/16 11:50:48 raptor Exp $ raptorlibnspr2 - Solaris 10 libnspr LDPRELOAD exploit Copyright c 2006 Marco Ivaldi [email protected] Local exploitation of a design error vulnerability in version 4.6.1 of NSPR, as include...
Solaris 10 libnspr - 'LD_PRELOAD' Arbitrary File Creation Privilege Escalation (2)
!/bin/sh $Id: raptorlibnspr2,v 1.4 2006/10/16 11:50:48 raptor Exp $ raptorlibnspr2 - Solaris 10 libnspr LDPRELOAD exploit Copyright c 2006 Marco Ivaldi Local exploitation of a design error vulnerability in version 4.6.1 of NSPR, as included with Sun Microsystems Solaris 10, allows attackers to...
Solaris 10 libnspr LD_PRELOAD Arbitrary File Creation Local Root Exploit
Exploit for solaris platform in category local exploits ======================================================================== Solaris 10 libnspr LDPRELOAD Arbitrary File Creation Local Root Exploit ======================================================================== !/bin/sh $Id:...
Solaris 10 libnspr - LD_PRELOAD Arbitrary File Creation Privilege Escalation (2)
Solaris 10 libnspr - LDPRELOAD Arbitrary File Creation Privilege Escalation 2 !/bin/sh $Id: raptorlibnspr2,v 1.4 2006/10/16 11:50:48 raptor Exp $ raptorlibnspr2 - Solaris 10 libnspr LDPRELOAD exploit Copyright c 2006 Marco Ivaldi Local exploitation of a design error vulnerability in version 4.6.1...
FreeBSD : openvpn -- LD_PRELOAD code execution on client through malicious or compromised server (be4ccb7b-c48b-11da-ae12-0002b3b60e4c)
Hendrik Weimer reports : OpenVPN clients are a bit too generous when accepting configuration options from a server. It is possible to transmit environment variables to client-side shell scripts. There are some filters in place to prevent obvious nonsense, however they don't catch the good old...
FreeBSD : scponly -- local privilege escalation exploits (b5a49db7-72fc-11da-9827-021106004fd6)
Max Vozeler reports : If ALL the following conditions are true, administrators using scponly-4.1 or older may be at risk of a local privilege escalation exploit : - the chrooted setuid scponlyc binary is installed - regular non-scponly users have interactive shell access to the box - a user...
Mandrake Linux Security Advisory : openvpn (MDKSA-2006:069)
A vulnerability in OpenVPN 2.0 through 2.0.5 allows a malicious server to execute arbitrary code on the client by using setenv with the LDPRELOAD environment variable. Updated packages have been patched to correct this issue by removing setenv support. %NASLMINLEVEL 70300 C Tenable Network...
Code injection
OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LDPRELOAD environment variable...
CVE-2006-1629
OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LDPRELOAD environment variable...
CVE-2006-1629
OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LDPRELOAD environment variable...
CVE-2006-1629
OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LDPRELOAD environment variable...
CVE-2006-1629
OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LDPRELOAD environment variable...
[SA19531] OpenVPN LD_PRELOAD Environment Variable Pushing Vulnerability
TITLE: OpenVPN LDPRELOAD Environment Variable Pushing Vulnerability SECUNIA ADVISORY ID: SA19531 VERIFY ADVISORY: http://secunia.com/advisories/19531/ CRITICAL: Less critical IMPACT: System access WHERE: From remote SOFTWARE: OpenVPN 2.x http://secunia.com/product/5568/ DESCRIPTION: Hendrik Weime...
openvpn -- LD_PRELOAD code execution on client through malicious or compromised server
Hendrik Weimer reports: OpenVPN clients are a bit too generous when accepting configuration options from a server. It is possible to transmit environment variables to client-side shell scripts. There are some filters in place to prevent obvious nonsense, however they don't catch the good old...
CVE-2005-4532
scponlyc in scponly 4.1 and earlier, when the operating system supports LDPRELOAD mechanisms, allows local users to execute arbitrary code with root privileges by creating a chroot directory in their home directory, hard linking to a system setuid application, and using a modified LDPRELOAD to...