484 matches found
Dynalink routers backdoor?
I was playing with a Dynalink RTA 230 http://www.dynalink.co.nz/products/rta230.htm, a linux based mips-cored adsl router. Looking at embedded linux system, i've found something like a backdoor: cat /etc/passwd admin:xxxxxobscuredxxxxx:0:0:Administrator:/:/bin/sh...
CVE-2004-0186
smbmnt in Samba 2.x and 3.x on Linux 2.6, when installed setuid, allows local users to gain root privileges by mounting a Samba share that contains a setuid root program, whose setuid attributes are not cleared when the share is mounted...
CVE-2004-0602
The CVE-2004-0602 issue affects FreeBSD 4.x/5.x Linux binary compatibility mode. A programming error in handling certain Linux system calls can allow a local attacker to read/overwrite kernel memory, potentially gaining privileges or causing a system panic. Remediation in the connected docs inclu...
rlpr <= 2.04 msg() Remote Format String Exploit
Exploit for linux platform in category remote exploits =============================================== rlpr 0,1,2 lnxstagetwo = "\x31\xc0\x89\xc3\x89\xc1\x89\xc2\xb2\x3f\x88\xd0\xb3\x04" lnxstagetwo += "\xcd\x80\x89\xd0\x41\xcd\x80\x89\xd0\x41\xcd\x80" execute /bin/sh lnxstagetwo += "\x90" 100...
JetRoot_pl.txt
!/usr/bin/perl use IO::Socket; This is an exploit for HP Web JetAdmin, the printer management server from HP. It is NOT about printers! The service usually runs on port 8000 on Windows, Solaris or Linux boxes. Greetz: The Phenoelit People, c-base crew, EEyE rock!, Halvar on the other side of the...
rsync 2.5.7 - Local Stack Overflow Local Privilege Escalation
rsync 2.5.7 - Local Stack Overflow Local Privilege Escalation / rsync / Includes for code to daemonize / include include include include // define PATH "/usr/local/bin/rsync" define BUFFSIZE 100 //define RET 0xbffffdfb / 88 bytes portbinding shellcode - linux-x86 - by bighawk bighawk warfare com...
----------========== OPEN3S-2003-08-08-eng-informix-onshowaudit ==========----------
----------========== OPEN3S-2003-08-08-eng-informix-onshowaudit ==========---------- Title: Local Vulnerability in IBM Informix IDS v9.40 onshowaudit binary Date: 08-08-2003 Platform: Only tested in Linux but can be exported to others. Impact: Users with exec perm over ./bin/onshowaudit can read...
Abyss Web Server 1.01.1 - Authentication Bypass
Abyss Web Server 1.01.1 - Authentication Bypass source: https://www.securityfocus.com/bid/9171/info It has been reported that Abyss Web Server is prone to an authentication bypass vulnerability that may allow an attacker to gain access to server resources. This issue may be carried out by accessi...
Abyss Web Server 1.0/1.1 - Authentication Bypass
source: https://www.securityfocus.com/bid/9171/info It has been reported that Abyss Web Server is prone to an authentication bypass vulnerability that may allow an attacker to gain access to server resources. This issue may be carried out by accessing a password protected directory under which th...
Gordano Messaging Suite 9.0 - 'WWW.exe' Denial of Service
source: https://www.securityfocus.com/bid/8576/info It has been reported that Gordano Messaging Suite may be prone to a denial of service issue allowing a remote attacker to send malformed HTTP GET requests to cause the WWW.exe process to crash. The problme may lead to the termination of services...
GtkFtpd 1.0.4 Remote Root Buffer Overflow Exploit
Exploit for linux platform in category remote exploits ================================================= GtkFtpd 1.0.4 Remote Root Buffer Overflow Exploit ================================================= / gtkftpdv1.0.4and below: remote root buffer overflow exploit. by: vade79/v9 v9 at...
CVE-2003-0476
The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, which allows local users to gain read access to restricted file descriptors...
Slight privilege elevation from bin to root in IBM DB2 7.1 - 8.1 all binaries
Title: Local Vulnerability in IBM DB2 7.1 - 8.1 all binaries Date: 27-07-2003 Platform: Only tested in Linux but can be exported to others. Only versions 7.1 and Enterprise Server Edition v8.1 were checked but could affect other versions. Impact: Slight privilege elevation from bin to root. Autho...
WsMp3d 0.x - Remote Heap Overflow
WsMp3d 0.x - Remote Heap Overflow / Title: Remote Heap Corruption Overflow vulnerability in WsMp3d + Exploit: 0x82-Remote.WsMp3d.again.c bash$ ./0x82--Remote.WsMp3d.again -h 61.37.xxx.xx -t2 WsMp3 Server Heap Corruption Remote root exploit by Xpl017Elz. + Hostname: 61.37.xxx.xx + Port num: 8000 +...
[USG- SA- 2003.001] USG Security Advisory (slocate)
-----BEGIN PGP SIGNED MESSAGE----- USG Security Advisory http://www.usg.org.uk/advisories/2003.001.txt [email protected] USG- SA- 2003.001 24- Jan- 2003 Package: slocate Vulnerability: local buffer overflow Type: local Risk: high, users can gain high privileges in the system. System tested:...
Perl 5.6.0 (on Linux) getpwuid() leave /etc/shadow opened
I'm not sure how serious this issue is, but I think it may cause problems in some environments. The system is Linux, RedHat 7.0, Perl 5.6.0, glibc 2.2.4, latest updates. Recently I run 'lsof' on unprivileged Apache httpd process running modperl application and was pretty surprised to see...
IBM Informix SE 7.25 sqlexec - Local Buffer Overflow (2)
source: https://www.securityfocus.com/bid/4891/info Informix is an enterprise database distributed and maintained by IBM. A buffer overflow vulnerability has been reported for Informix-SE for Linux. The overflow is due to an unbounded string copy of the INFORMIXDIR environment variable to a local...
EZNE.NET Ezboard 2000 - Remote Buffer Overflow
source: https://www.securityfocus.com/bid/4068/info Ezboard 2000 is a web based bulletin board system. It is available for Linux systems. A vulnerability has been reported in some versions of Ezboard. In some CGI programs, user supplied data is written to a staticly sized array with a sprintf cal...
CVE-2000-0867
Kernel logging daemon klogd in Linux does not properly cleanse user-injected format strings, which allows local users to gain root privileges by triggering malformed kernel messages...
Mandriva Linux Mandrake 7.0 - Local Buffer Overflow
// source: https://www.securityfocus.com/bid/1265/info The linux cdrecorder binary is vulnerable to a locally exploitable buffer overflow attack. When installed in a Mandrake 7.0 linux distribution, it is by default setgid "cdburner" which is a group, gid: 80, that is created for the application...