mailx 8.1.1-10 (BSDSlackware) - Local Buffer Overflow (2)

mailx 8.1.1-10 BSDSlackware - Local Buffer Overflow 2 / source: https://www.securityfocus.com/bid/1305/info Some Linux distributions ship with BSD mailx 8.1.1-10 On Slackware 7.x it can be found as /usr/bin/Mail. A vulnerability exists in the 'mail' program, part of the Berkeley mailx package. Th...

Xi Graphics Accelerated X 4.0.x/5.0 - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/488/info Accelerated-X, also known as Accel-X, is a popular commercial X server available from Xi Graphics. The servers are normally installed setuid root, and contain multiple buffer overflow vulnerabilities. These vulnerabilities were found in the...

Xcmail 0.99.6 - Local Buffer Overflow

/ source: https://www.securityfocus.com/bid/311/info XCmail is an X11 mail client for linux. Arthur discovered an exploitable buffer overflow vulnerability in xcmail. The bug appears when replying to a message with a long subject line, and only when autoquote is on. The exploit is trivial, but as...

Debian 2.02.0 r5 FreeBSD 3.2 OpenBSD 2.4 RedHat 5.2 i386 S.u.S.E 6.1 - Lsof Local Buffer Overflow (1)

Debian 2.02.0 r5 FreeBSD 3.2 OpenBSD 2.4 RedHat 5.2 i386 S.u.S.E 6.1 - Lsof Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/496/info // // Lsof is an open file management utility included with many linux distributions. When run setuid root or setgid kmem, it is subject to a...

Solaris 2.5.1 - 'kcms' Local Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/452/info There is an unchecked sprintf call in the versions of /usr/openwin/bin/kcmsconfigure shipped with solaris 2.5, 2.5.1 and 2.6. Unfortunately, kcmsconfigure is installed setuid root, making it possible for an attacker to overflow the buffer and...

BSD 'lpr' 2000.05.07/0.48/0.72 / lpr-ppd 0.72 - Local Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/7025/info It has been reported that a vulnerability in the handling of some types of requests exists in lprm. When an attacker sends a maliciously crafted string to a configured printer through the lprm command, it may be possible to execute code. /...

BSD lpr 2000.05.070.480.72 lpr-ppd 0.72 - Local Buffer Overflow (2)

BSD lpr 2000.05.070.480.72 lpr-ppd 0.72 - Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/7025/info It has been reported that a vulnerability in the handling of some types of requests exists in lprm. When an attacker sends a maliciously crafted string to a configured printer...

BSD 'lpr' 2000.05.07/0.48/0.72 / lpr-ppd 0.72 - Local Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/7025/info It has been reported that a vulnerability in the handling of some types of requests exists in lprm. When an attacker sends a maliciously crafted string to a configured printer through the lprm command, it may be possible to execute code. /...

Armidale Software Yapp Conferencing System 2.2 - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/365/info Armidale Software's Yapp Conferencing System is vulnerable to an environment variable related buffer overflow vulnerability in at least the Linux version. The consequence of the vulnerability being exploited is a local root compromise. / Explo...

Armidale Software Yapp Conferencing System 2.2 - Local Buffer Overflow

Armidale Software Yapp Conferencing System 2.2 - Local Buffer Overflow // source: https://www.securityfocus.com/bid/365/info Armidale Software's Yapp Conferencing System is vulnerable to an environment variable related buffer overflow vulnerability in at least the Linux version. The consequence o...

IRIX 5.3 - usrsbiniwsh Local Buffer Overflow Local Privilege Escalation

IRIX 5.3 - usrsbiniwsh Local Buffer Overflow Local Privilege Escalation / /usr/sbin/iwsh.c exploit by DCRH 27/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 Irix 5.x only compile as: cc iwsh.c / include include include include include define NUMADDRESSES 500 define BUFLENGTH 500 define...

Slackware Linux 3.1/3.2 - 'color_xterm' Local Buffer Overflow (1)

source: https://www.securityfocus.com/bid/369/info In Slackware Linux 3.1 and 3.2, the version of color xterm included is vulnerable to a buffer overflow attack that allows for a local user to gain root access. / exploit for colorxterm, modified by zgv / / original exploit coded by Ming Zhang for...

AIX 4.2 - '/usr/dt/bin/dtterm' Local Buffer Overflow

include include include char prog100="/usr/dt/bin/dtterm"; char prog230="dtterm"; extern int execv; char createvarchar name,char value char c; int l; l=strlenname+strlenvalue+4; if ! c=mallocl perror"error allocating";exit2;; strcpyc,name; strcatc,"="; strcatc,value; putenvc; return c; /The...

IRIX 5.3 - '/usr/sbin/iwsh' Local Buffer Overflow / Local Privilege Escalation

/ /usr/sbin/iwsh.c exploit by DCRH 27/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 Irix 5.x only compile as: cc iwsh.c / include include include include include define NUMADDRESSES 500 define BUFLENGTH 500 define EXTRA 9000 define OFFSET 0x180 define GPOFFSET -0x80 define IRIXNOP...

AIX 4.2 - usrdtbindtterm Local Buffer Overflow

AIX 4.2 - usrdtbindtterm Local Buffer Overflow include include include char prog100="/usr/dt/bin/dtterm"; char prog230="dtterm"; extern int execv; char createvarchar name,char value char c; int l; l=strlenname+strlenvalue+4; if ! c=mallocl perror"error allocating";exit2;; strcpyc,name; strcatc,"=...

AIX 4.2 /usr/dt/bin/dtterm Local Buffer Overflow Exploit

Exploit for aix platform in category local exploits ======================================================== AIX 4.2 /usr/dt/bin/dtterm Local Buffer Overflow Exploit ======================================================== include include include char prog100="/usr/dt/bin/dtterm"; char...

AIX lquerylv - Local Buffer Overflow / Local Privilege Escalation

include include include char prog100="/usr/sbin/lquerylv"; char prog230="lquerylv"; extern int execv; char createvarchar name,char value char c; int l; l=strlenname+strlenvalue+4; if ! c=mallocl perror"error allocating";exit2;; strcpyc,name; strcatc,"="; strcatc,value; putenvc; return c; /The...

SGI IRIX - binlogin Local Buffer Overflow

SGI IRIX - binlogin Local Buffer Overflow / /bin/login exploit by DCRH 24/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 R5000 O2 Irix 6.3 R8000 Power Challenge Irix 6.2 Compile as: cc -n32 login.c for Irix 6.x cc login.c for Irix 5.x Press enter when prompted for a password / include...

AIX lquerylv - Local Buffer Overflow Local Privilege Escalation

AIX lquerylv - Local Buffer Overflow Local Privilege Escalation include include include char prog100="/usr/sbin/lquerylv"; char prog230="lquerylv"; extern int execv; char createvarchar name,char value char c; int l; l=strlenname+strlenvalue+4; if ! c=mallocl perror"error allocating";exit2;;...

SGI IRIX - '/bin/login' Local Buffer Overflow

/ /bin/login exploit by DCRH 24/5/97 Tested on: R3000 Indigo Irix 5.3 R4400 Indy Irix 5.3 R5000 O2 Irix 6.3 R8000 Power Challenge Irix 6.2 Compile as: cc -n32 login.c for Irix 6.x cc login.c for Irix 5.x Press enter when prompted for a password / include include include include include define...