ISDN4Linux 3.1 - IPPPD Device String SysLog Format String (1)

ISDN4Linux 3.1 - IPPPD Device String SysLog Format String 1 // source: https://www.securityfocus.com/bid/5437/info isdn4linux is a freely available, open source package of isdn compatibility tools. It is available for Linux operating systems. isdn4linux contains a format string vulnerability in t...

CVE-2002-0827

Vulnerability in pppd on UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to gain root privileges via 1 ppptalk or 2 ppp, a different vulnerability than CVE-2002-0824...

[SECURITY] [DSA 139-1] New super packages fix local root exploit

-------------------------------------------------------------------------- Debian Security Advisory DSA 139-1 [email protected] http://www.debian.org/security/ Martin Schulze August 1st, 2002 - -------------------------------------------------------------------------- Package : super...

[SECURITY] [DSA 139-1] New super packages fix local root exploit

-------------------------------------------------------------------------- Debian Security Advisory DSA 139-1 [email protected] http://www.debian.org/security/ Martin Schulze August 1st, 2002 - -------------------------------------------------------------------------- Package : super...

RAZOR advisory: Linux util-linux chfn local root vulnerability

Linux util-linux chfn local root vulnerability Issue Date: July 29, 2002 Contact: Michal Zalewski CVE: CAN-2002-0638 CERT vulnerability note: http://www.kb.cert.org/vuls/id/405955 the URL should be accessible soon Topic: A locally exploitable vulnerability is present in the util-linux package...

FreeBSD 4.x / NetBSD 1.4.x/1.5.x/1.6 / OpenBSD 3 - pppd Arbitrary File Permission Modification Race Condition

source: https://www.securityfocus.com/bid/5355/info A vulnerability has been reported in some versions of the pppd daemon included with multiple BSD distributions. A race condition error in the code may result in the pppd process changing the file permissions on an arbitrary system file. pppd wil...

LOCAL ROOT EXPLOIT - SUPPORT FULL-DISCLOSURE - LOCAL ROOT EXPLOIT

!/usr/bin/perl fartsy.pl by kanix [email protected] /usr/sbin/artswrapper local format string exploit Tested on Red Hat Linux release 7.2 Enigma Jul 6, 2002 "the secret to creativity is knowing how to hide your sources." - Albert Einstein commentz, job offerz, flamez, etc. should be directed t...

[AP] Cisco vpnclient buffer overflow

-- ------------------------- -- - AngryPacket Security Advisory - -- ------------------------- -- - +--------------------- -- - + advisory information +------------------ -- - author: methodic [email protected] release date: 05/28/2002 homepage: http://sec.angrypacket.com advisory...

Cisco VPN Client for Unix 3.5.1 - Local Buffer Overflow

Cisco VPN Client for Unix 3.5.1 - Local Buffer Overflow // source: https://www.securityfocus.com/bid/5056/info The Cisco VPN Client software is used to establish Virtual Private Network VPN connections between client machines and a Cisco VPN Concentrator. A vulnerability has been reported in some...

Interbase 6.0 malloc() issues

====================================================================== Strategic Reconnaissance Team Security Advisory SRT2002-06-17-1043 Topic : Interbase 6.0-1 Date : June 17, 2002 Credit : KF dotslashatsnosoft.com Site : http://www.snosoft.com...

New Kismet Packages available - SayText() and suid kismet_server issues

I have discovered 2 potentially exploitable holes in the wireless sniffer package Kismet. Both issues have been addressed by the author. I am in the process of determining if the local command line overflow is exploitable or not. The other issue may be dependant on if your OS will allow you to...

CVE-2002-0184

Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain root privileges via special characters in the -p prompt argument, which are not properly expanded...

Multiple bugs in Solaris utils

Local and remoter root compromise via buffer overflows and remote DoS attacks...

Apple Mac OSX 10.x / FreeBSD 4.x / OpenBSD 2.x / Solaris 2.5/2.6/7.0/8 - 'exec C Library' Standard I/O File Descriptor Closure

/ source: https://www.securityfocus.com/bid/4568/info It has been reported that BSD-based kernels do not check to ensure that the C library standard I/O file descriptors 0-2 are valid open files before execing setuid images. Consequently, I/O that are opened by a setuid process may be assigned fi...

Apple Mac OSX 10.x FreeBSD 4.x OpenBSD 2.x Solaris 2.52.67.08 - exec C Library Standard IO File Descriptor Closure

Apple Mac OSX 10.x FreeBSD 4.x OpenBSD 2.x Solaris 2.52.67.08 - exec C Library Standard IO File Descriptor Closure / source: https://www.securityfocus.com/bid/4568/info It has been reported that BSD-based kernels do not check to ensure that the C library standard I/O file descriptors 0-2 are vali...

[UNIX] Suid Application Execution May Give Local Root

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion When was the last time you checked your server's security? How about a monthly report? http://www.AutomatedScanning.com - Know that you're...

OpenSSH 2.2.0 - 3.1.0 server contains a locally exploitable buffer overflow

effect: local root vulnerable services: -pass Kerberos IV TGT -pass AFS Token bug details: radix.c GETSTRING macro in radixtocreds function may cause buffer overflow. affected buffers: creds-service creds-instance creds-realm creds-pinst exploit code here: mantra.freeweb.hu...

IBM Informix Web DataBlade: Local root by design

IBM Informix Web DataBlade: Local root by design By Simon Lodal, Denmark Vendor status: Notified months ago, said they would be working on updates, never heard anything. Software: Web DataBlade 4.12, IDS 9.20/9.21, Linux 2.2/2.4, SunOS 5.7 OS, IDS and WDB versions seem to be irrelevant. Impact: A...

OpenBSD Local Root Compromise

ZOOM International Security Advisory OpenBSD local root compromise Systems affected: OpenBSD all version, OpenBSD Current prior April 8, 2002 Risk: High Date: April 11, 2002 Legal Notice: This advisory is copyright c ZOOM International. Disclaimer: Information contained in this advisory are...

CVE-1999-1021

NFS on SunOS 4.1 through 4.1.2 ignores the high order 16 bits in a 32 bit UID, which allows a local user to gain root access if the lower 16 bits are set to 0, as fixed by the NFS jumbo patch upgrade...