FreeBSD 4.x,NetBSD 1.4.x/1.5.x/1.6,OpenBSD 3 pppd Arbitrary File Permission Modification Race Condition

No description provided by source. source: http://www.securityfocus.com/bid/5355/info A vulnerability has been reported in some versions of the pppd daemon included with multiple BSD distributions. A race condition error in the code may result in the pppd process changing the file permissions on ...

NetBSD/FreeBSD Port Systrace 1.x Exit Routine Access Validation Privilege Escalation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10320/info A vulnerability has been reported that affects Systrace on NetBSD, as well as the FreeBSD port by Vladimir Kotal. The source of the issue is insufficient access validation when a systraced process is restoring...

K-Meleon 1.5.3 - Remote Array Overrun

No description provided by source. From Full Disclosure: http://seclists.org/fulldisclosure/2009/Nov/222 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 K-Meleon 1.5.3 Remote Array Overrun Arbitrary code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - - Dis.:...

SeaMonkey 1.1.8 - Remote Array Overrun

No description provided by source. From Full Disclosure: http://seclists.org/fulldisclosure/2009/Nov/221 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SeaMonkey 1.1.8 Remote Array Overrun Arbitrary code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - - Dis.:...

Rogue 5.3 - Local Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5837/info Rogue is a game included with BSD distributions including FreeBSD and NetBSD. By passing an overly long value when restoring a saved game, it is possible for an attacker to corrupt memory. Exploitation of this...

NetBSD 1.x TalkD User Validation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4419/info talkd is a client-server application shipped with many Unix and Linux variants that is used for communication between users locally or remotely. talkd does not perform adequate validation of users making talk...

BSD PPP 'pppx.conf' - Local Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28090/info BSD PPP is prone to a local denial-of-service vulnerability because it fails to perform adequate boundary checks on user-supplied input. Attackers can leverage this issue to crash the application and deny servi...

NetBSD 3.1 Ftpd and Tnftpd Port Remote Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/21377/info NetBSD ftpd and tnftpd are prone to a remote buffer-overflow vulnerability. This issue is due to an off-by-one error; it allows attackers to corrupt memory. Remote attackers may execute arbitrary machine code i...

NetBSD <= 5.0.1 'IRET' General Protection Fault Handling Local Privilege Escalation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/36430/info NetBSD is prone to a local privilege-escalation vulnerability. A local attacker may exploit this issue to cause the kernel stack to become desynchronized. This may allow the attacker to gain elevated privileges...

FreeBSD <= 5.0,NetBSD <= 1.4.2,OpenBSD <= 2.7 setsockopt() Dos

No description provided by source. source: http://www.securityfocus.com/bid/622/info A denial of service attack exists that affects FreeBSD, NetBSD and OpenBSD, and potentially other operating systems based in some part on BSD. It is believed that all versions of these operating systems are...

GNU libc/regcomp(3) Multiple Vulnerabilities

No description provided by source. source: http://securityreason.com/securityalert/8003 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 GNU libc/regcomp3 Multiple Vulnerabilities Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.net/ Date: - - Dis.: 01.10.2010 - - Pub.:...

RedHat Linux 7.0 Roaring Penguin PPPoE Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2098/info Roaring Penguin Software's PPPoE is a freeware PPP over Ethernet client often used by ADSL subscribers running Linux or NetBSD. PPPoE contains a possibly remotely exploitable denial of service vulnerability in i...

netbsd/x86 setreuid(0, 0); execve("/bin//sh", ..., NULL); 29 bytes

No description provided by source. / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, setreuid0, 0; execve/bin//sh, ..., NULL; note: unsafe shellcode, but 29 bytes long; doesn't work if eax & 0x40000000 != 0; / include sys/types.h include stdio.h include string.h char scode = \x99 // cltd...

NetBSD 5.0 and below Hack PATH Environment overflow proof of concept

No description provided by source. !/bin/sh NetBSD 5.0 and below Hack PATH Environment overflow proof of concept Successfull Exploitation gives guid 100 games Vulnerable Function is in hack.unix.c It is a basic strcpy stack overflow. Such overflows are hard to exploit in NetBSD. If you can exploi...

BSD/OS <= 4.0,FreeBSD <= 3.2,Linux kernel <= 2.3,NetBSD <= 1.4 Shared Memory Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/526/info Operating systems with a shared memory implementation based on or influenced by the 4.4BSD code may be vulnerable to a denial of service attack The problem exists because you can mmap or shmget as much memory as...

Multiple BSD Distributions 'printf(3)' Memory Corruption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/36885/info Multiple BSD distributions are prone to a memory-corruption vulnerability because the software fails to properly bounds-check data used as an array index. An attacker can exploit this issue to cause application...

X11R6 3.3.3 Symlink Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/326/info There is a symlink vulnerability known to exist under most modern linux and NetBSD distributions. It involves /tmp/.X11-unix and the tendency to follow to/overwrite the file pointed to if a symlink. It may be...

IPComp encapsulation pre-auth kernel memory corruption

No description provided by source. //source: http://lists.grok.org.uk/pipermail/full-disclosure/2011-April/080031.html BSD derived RFC3173 IPComp encapsulation will expand arbitrarily nested payload ------------------------------------------------------------------------------- Gruezi, this...

netbsd/x86 setreuid(0, 0); execve("/bin//sh", ..., NULL); 30 bytes

No description provided by source. / minervini at neuralnoise dot com c 2005 NetBSD/i386 2.0, setreuid0, 0; execve/bin//sh, ..., NULL; / include sys/types.h include stdio.h include string.h char scode = \x31\xc0 // xor %eax,%eax \x50 // push %eax \x50 // push %eax \x50 // push %eax \x34\x7e // xo...

Multiple BSD Distributions 'gdtoa/misc.c' Memory Corruption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/35510/info Multiple BSD distributions are prone to a memory-corruption vulnerability because the software fails to properly bounds-check data used as an array index. Attackers may exploit this issue to execute arbitrary...