Дырка в libc старых версий Solaris (getgrnam)

Классическое переполнение буфера в getgrnam...

lpset.overflow

Here's an overflow exploit that works on a non-exec stack on x86 boxes. It demonstrates how it is possible to thread together several libc calls. I have not seen any other exploits for x86 that have done this.. for the lpset bug in sol7 x86. Tim N. define BASE 0xdff40000 define STACK 0x8047e30...

CVE-1999-0964

CVE-1999-0964: Buffer overflow in FreeBSD libc setlocale triggered by a long PATH_LOCALE environment variable. The flaw enables local attackers to execute arbitrary code, with impacts listed as complete confidentiality, integrity and availability. Root cause is a buffer overflow in setlocale; no ...

CVE-1999-0789

Buffer overflow in AIX ftpd in the libc library...

CVE-1999-0789

CVE-1999-0789 concerns a buffer overflow in the AIX ftpd (FTP daemon) within the libc library. Connected sources describe the root cause as a buffer overflow in the libc used by AIX FTPd, with offshoots noting a remote overflow that could crash the FTP server and, in some reports, allow the remot...

CVE-1999-0966

The vulnerability is in the Solaris libc: a buffer overflow in the getopt function that can be triggered by a long argv[0], potentially allowing local users to gain root privileges. Connected PT-security data confirms Solaris as the affected platform and notes that affected versions are not speci...

CVE-1999-0966: Undefined Security Weakness

Buffer overflow in Solaris getopt in libc allows local users to gain root privileges via a long argv0...

CVE-1999-0964: Undefined Security Weakness

Buffer overflow in FreeBSD setlocale in the libc module allows attackers to execute arbitrary code via a long PATHLOCALE environment variable...

CVE-1999-0789: Undefined Security Weakness

Buffer overflow in AIX ftpd in the libc library...

CVE-1999-0767

CVE-1999-0767 is a buffer overflow vulnerability described in Solaris components (libc, ufsrestore, and rcp) triggered via the LC_MESSAGES environment variable. The available connected records confirm the affected software and the root cause (buffer overflow), with the PT-1999-1338 entry reiterat...

CVE-1999-0767

Buffer overflow in Solaris libc, ufsrestore, and rcp via LCMESSAGES environmental variable...

CVE-1999-0767: Undefined Security Weakness

Buffer overflow in Solaris libc, ufsrestore, and rcp via LCMESSAGES environmental variable...

[SECURITY] Updated i386 package for sendmail

The version of sendmail that was listed in the earlier advisory today was compiled with the wrong version of libc. This has been corrected in version 8.9.3-3slink1.0.1 . wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Intel ia32 architecture:...

[SECURITY] Updated i386 package for sendmail

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman December 7, 1999 - ------------------------------------------------------------------------ The version of sendmail that was...

CVE-1999-0789

Buffer overflow in AIX ftpd in the libc library...

CVE-1999-0767

Buffer overflow in Solaris libc, ufsrestore, and rcp via LCMESSAGES environmental variable...

PT-1999-1338 · Oracle · Solaris

Name of the Vulnerable Software and Affected Versions: Solaris affected versions not specified Description: The issue is related to a buffer overflow in Solaris libc, ufsrestore, and rcp, which can be triggered via the LC MESSAGES environmental variable. Recommendations: At the moment, there is n...

defeat.solaris.nonexec.stack.txt

Hi, I've recently been playing around with bypassing the non-executable stack protection that Solaris 2.6 provides. I'm referring to the mechanism that you control with the noexecuserstack option in /etc/system. I've found it's quite possible to bypass this protection, using methods described...

libc.nul.byte.txt

Date: Wed, 14 Oct 1998 11:42:46 +0200 From: Olaf Kirch To: [email protected] Subject: The poisoned NUL byte Summary: you can exploit a single-byte buffer overrun to gain root privs. When, half a day after releasing version 2.2beta37 of the Linux nfs server, I received a message from Larry...

fts.find.du.bsd.txt

Date: Wed, 12 May 1999 14:32:42 +0400 From: Stas Kisel To: [email protected] Subject: fts, du, find Hi. I use FreeBSD-2.2.8 and FreeBSD-2.2.7 and I know that these versions are no longer supported, but: 1. There are many people still using 2.2 2. This bug probably applies to FreeBSD-3.1 and ev...