lil' exim format bug

Hi BugTrackers Just a little bug to tell: THE BUG ------- accept.c, line 2506: else if smtpreply != NULL moansmtpbatchNULL, smtpreply; while moansmtpbatch is like this: moansmtpbatchchar cmdbuffer, char format, ... So when smtpreply contains format strings, it get transformed by moansmtpbatch. Wh...

Exim 3.x - Format String

Exim 3.x - Format String source: https://www.securityfocus.com/bid/2828/info Exim is a free, open-source Mail Transfer Agent for Unix systems. Exim is vulnerable to a locally exploitable format string attack which may compromise root access. The vulnerability exists only when the 'syntax checking...

[synnergy] - Solaris mailtool(1) buffer overflow vulnerability

Vulnerability in Solaris mailtool1 Date Published: May 29, 2001 Advisory ID: N/A Bugtraq ID: N/A Sun Bug ID: 4458476 CVE CAN: Non currently assigned. Title: Solaris mailtool1 Buffer Overflow Vulnerability Class: Boundary Error Condition Remotely Exploitable: No Locally Exploitable: Yes Vulnerable...

CVE-2001-0426

CVE-2001-0426 describes a buffer overflow in the dtsession component affecting Solaris (and possibly other OSes) that lets local users gain privileges when a long LANG environment variable is processed. The vulnerability is triggered by excessively long LANG values, leading to privilege escalatio...

[SECURITY] [DSA-056-1] man-db local exploit

Package : man-db Problem type : local file overwrite Debian-specific: no Ethan Benson found a bug in man-db packages as distributed in Debian/GNU/Linux 2.2. man-db includes a mandb tool which is used to build an index of the manual pages installed on a system. When the -u or - -c option were give...

IRIX (5.3/6.2/6.3/6.4/6.5/6.5.11) /usr/lib/print/netprint Local Exploit

Exploit for irix platform in category local exploits ======================================================================= IRIX 5.3/6.2/6.3/6.4/6.5/6.5.11 /usr/lib/print/netprint Local Exploit ======================================================================= !/bin/sh copyright LAST STAGE ...

CVE-2001-0033

CVE-2001-0033 affects KTH Kerberos IV. Local users can alter a Kerberos server’s configuration by supplying an alternate directory via the KRBCONFDIR environmental variable, enabling escalation of privileges. The description identifies the root cause as the ability to specify a custom configurati...

CVE-2001-0316

CVE-2001-0316 affects Linux kernels 2.2 and 2.4 where sysctl can be invoked with a negative length, allowing unprivileged local users to read kernel memory and potentially obtain root privileges. Mitigation in the public records points to upgrading to kernel 2.2.19 or later (and vendor advisories...

CVE-2000-1119

CVE-2000-1119 : A buffer overflow in the IBM AIX setsenv command (affected: AIX 4.3.x and earlier) can allow a local attacker to execute arbitrary commands with root privileges. The root cause is a vulnerable parameter handling in the setsenv utility; an exploit has been publicly available and re...

Vixie Cron crontab 3.0 - Privilege Lowering Failure (1)

source: https://www.securityfocus.com/bid/2687/info Vixie cron is an implementation of the popular UNIX program that runs user-specified programs at periodic scheduled times. When a parsing error occurs after a modification operation, crontab will fail to drop privileges correctly for subsequent...

IRIX (5.3/6.2/6.3/6.4/6.5/6.5.11) /usr/bin/lpstat Local Exploit

Exploit for irix platform in category local exploits =============================================================== IRIX 5.3/6.2/6.3/6.4/6.5/6.5.11 /usr/bin/lpstat Local Exploit =============================================================== !/bin/sh copyright LAST STAGE OF DELIRIUM jul 2000...

[SECURITY] [DSA 050-1] New version sendfile fix local root exploit

---------------------------------------------------------------------------- Debian Security Advisory DSA 050-1 [email protected] http://www.debian.org/security/ Martin Schulze April 20, 2001 - ---------------------------------------------------------------------------- Package : sendfile...

Samba 2.0.x - Insecure TMP File Symbolic Link

Samba 2.0.x - Insecure TMP File Symbolic Link // source: https://www.securityfocus.com/bid/2617/info Samba is a flexible file sharing packaged maintained by the Samba development group. It provides interoperatability between UNIX and Microsoft Windows systems, permitting the sharing of files and...

SGI IRIX 6.5 / Solaris 7.0/8 CDE - '/usr/dt/bin/dtsession' Local Buffer Overflow

/ source: https://www.securityfocus.com/bid/2603/info The CDE Session Manager 'dtsession' is vulnerable to a buffer overflow that could yield root privileges to an attacker. The bug exists in dtsession's LANG environment variable parser. If an overly long LANG variable is set and dtsession is...

CVE-2001-0315

CVE-2001-0315 affects mIRC 5.7. The vulnerability arises from the locking feature, where local users can bypass the password mechanism by modifying the LockOptions registry key. Exploitation requires local access; the CVSS base score is 7.5 (HIGH) with partial impacts to confidentiality, integrit...

SCO OpenServer 5.0.6 - lpadmin Buffer Overflow

source: https://www.securityfocus.com/bid/2553/info SCO OpenServer 5.0.6 and possibly earlier versions ships with several suid 'bin' executables used in printer administration and related tasks. This includes lpadmin, a component used to manage and configure print destinations, devices and printe...

Solaris 2.5/2.6/7.0/8 tip - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/2475/info tip is a utility included with Sun Microsystems Solaris Operating Environment. tip allows a user to establish a full duplex terminal connection with a remote host. A problem with tip could lead to a buffer overflow. Due to the improper handli...

SCO Open Server 5.0.6 - recon Buffer Overflow

SCO Open Server 5.0.6 - recon Buffer Overflow source: https://www.securityfocus.com/bid/2560/info SCO OpenServer 5.0.6 and possibly earlier versions ships with a suid 'bin' executable called 'recon'. 'recon' is used to buffer and forward escape sequences from a user's input to timing-sensitive...

[SECURITY] [DSA-041-1] joe local attack via joerc

Package : joe Problem type : local exploit Debian-specific: no Christer Öberg of Wkit Security AB found a problem in joe Joes Own Editor. joe will look for a configuration file in three locations: the current directory, the users homedirectory $HOME and in /etc/joe. Since the configuration file c...

Slackware 7.1 /usr/bin/mail Local Exploit

Exploit for linux platform in category local exploits ========================================= Slackware 7.1 /usr/bin/mail Local Exploit ========================================= / Slackware 7.1 /usr/bin/Mail Exploit give gid=1 bin if /usr/bin/Mail is setgid but it is not setgid, setuid for...