Локальный root через X-сервер

Переполнение буфера при вызове XFree86 с параметром -xkbmap и длинным аргументом. При этом аргумент может содержать только текстовые символы, что затрудняет эксплоит, но не делает его невозможным...

FreeBSD Security Advisory: FreeBSD-SA-00:12.healthd

============================================================================= FreeBSD-SA-00:12 Security Advisory FreeBSD, Inc. Topic: healthd allows a local root compromise Category: ports Module: healthd Announced: 2000-04-10 Credits: Discovered during FreeBSD ports collection auditing. Affects:...

FreeBSD-SA-00:12.healthd

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:12 Security Advisory FreeBSD, Inc. Topic: healthd allows a local root compromise Category: ports Module: healthd Announced: 2000-04-10 Credits: Discovered during FreeBSD...

Local root compromise in GNQS 3.50.6 and 3.50.7

A large security hole was uncovered last month in Generic-NQS ver. 3.50.6 and 3.50.7. This hole leads to immediate local root compromise. All users of those versions are requested to upgrade to ver. 3.50.8 or later ASAP. The updated package can be downloaded from...

Security Advisory: FreeBSD-SA-00:09.mtr

============================================================================= FreeBSD-SA-00:09 Security Advisory FreeBSD, Inc. Topic: mtr port contains a local root exploit. Category: ports Module: mtr Announced: 2000-03-15 Affects: Ports collection before the correction date. Corrected: 2000-03-...

FreeBSD-SA-00:10.orville-write

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:10 Security Advisory FreeBSD, Inc. Topic: orville-write port contains local root compromise. Category: ports Module: orville-write Announced: 2000-03-15 Affects: Ports...

FreeBSD-SA-00:09.mtr

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:09 Security Advisory FreeBSD, Inc. Topic: mtr port contains a local root exploit. Category: ports Module: mtr Announced: 2000-03-15 Affects: Ports collection before the...

Halloween Linux 4.0 RedHat Linux 6.16.2 - imwheel (1)

Halloween Linux 4.0 RedHat Linux 6.16.2 - imwheel 1 // source: https://www.securityfocus.com/bid/1060/info A vulnerability exists in the 'imwheel' package for Linux. This package is known to be vulnerable to a buffer overrun in its handling of the HOME environment variable. By supplying a...

AT Computing atsar_linux 1.4 - File Manipulation

source: https://www.securityfocus.com/bid/1048/info atsar is a linux load monitoring software package released under the GPL by AT Computing. atsadc is a setuid root binary that is included in the atsar package. atsadc is setuid because it obtains informatin via /dev/kmem. atsadc will accept as a...

dosemu.sh

[email protected] - Corel Linux dosemu config error. Local root compromise. Software: Corel Linux 1.0 dosemu distribution configuration URL: http://linux.corel.com Version: Version 1.0 The system.com command is available to any user who runs the dos emulator. This is a direct violation of the advice...

FreeBSD-SA-00:03.asmon

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:03 Security Advisory FreeBSD, Inc. Topic: Asmon/Ascpu ports fail to drop privileges Category: ports Module: asmon/ascpu Announced: 2000-02-19 Affects: Ports collection...

CVE-1999-0092

Various vulnerabilities in the AIX portmir command allows local users to obtain root access...

CVE-1999-0411

The vulnerability CVE-1999-0411 affects SCO OpenServer Enterprise System v5.0.4p, where startup scripts S84rpcinit, S95nis, S85tcp, and S89nfs are susceptible to a symlink attack that can let a local user gain root access. The root cause is a symlink-attack in the startup scripts, enabling privil...

FreeBSD-SA-00:02.procfs

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:01 Security Advisory FreeBSD, Inc. Topic: Old procfs hole incompletely filled Category: core Module: make Announced: 2000-01-24 Affects: All versions before the correctio...

Mandrake 6.x / RedHat 6.x / Turbolinux 3.5 b2/4.x/6.0.2 userhelper/PAM - Path (1)

Mandrake 6.0/6.1,RedHat 6.0/6.1,Turbolinux 3.5 b2/4.2/4.4/6.0.2 userhelper/PAM Path Vulnerability 1 source: https://www.securityfocus.com/bid/913/info Because of double path vulnerabilities in the binary userhelper and PAM, it is possible to get root locally on RedHat 6.0 and 6.1 systems. Both...

IBM Network Station Manager 2.0 R1 - Race Condition

// source: https://www.securityfocus.com/bid/900/info IBM's Network Station Manager is a client/server application which facilitates management for IBM Network Stations. It is possible to locally gain root priviliges on hosts running the NetStation daemon. NetStation which runs as root creates...

FreeBSD 3.3 - gdc Local Buffer Overflow

FreeBSD 3.3 - gdc Local Buffer Overflow // source: https://www.securityfocus.com/bid/834/info There is a buffer overflow vulnerability known to be present in the version of gdc shipped with the 3.3-RELEASE version of FreeBSD. By default, only users in group wheel have execute access to gdc. The...

FreeBSD 3.3 - 'gdc' Local Buffer Overflow

// source: https://www.securityfocus.com/bid/834/info There is a buffer overflow vulnerability known to be present in the version of gdc shipped with the 3.3-RELEASE version of FreeBSD. By default, only users in group wheel have execute access to gdc. The overflow occurs when the argument passed...

RH6_rpmmail_exploit.txt

Greetings, A vulnerability exists in the rpmmail package distributed on the Red Hat 6.0 Extra Applications CD. The potential compromise for this bug could be remote or local root or simply remote command execution as "nobody" or similar, depending on your system configuration. By sending a...

SuSE_root_exploit.txt

nlservd/rnavc local root exploit for Linux x86 tested on SuSE 6.2 exploits Arkiea's Knox backup package. gcc -o knox knox.c ./knox NOTE: you MUST have void mainsetuidgeteuid; system"/bin/bash"; compiled in /tmp/ui for this to work. To exploit rnavc, simply change the execl call to...