OpenBSD Security Advisory: Select Boundary Condition

OpenBSD Security Advisory adv.select Original Release Date: 2002-08-11 1. Systems affected: All versions of OpenBSD. 2. Overview: Insufficient boundary checks in the select call allow an attacker to overwrite kernel memory and execute arbitrary code in kernel context. Traditionally, the size...

CVE-2002-0514

PF in OpenBSD 3.0 with the return-rst rule sets the TTL to 128 in the RST packet, which allows remote attackers to determine if a port is being filtered because the TTL is different than the default TTL...

CVE-2002-0766

OpenBSD 2.9 through 3.1 allows local users to cause a denial of service resource exhaustion and gain root privileges by filling the kernel's file descriptor table and closing file descriptors 0, 1, or 2 before executing a privileged process, which is not properly handled when OpenBSD fails to ope...

FreeBSD 4.x NetBSD 1.4.x1.5.x1.6 OpenBSD 3 - pppd Arbitrary File Permission Modification Race Condition

FreeBSD 4.x NetBSD 1.4.x1.5.x1.6 OpenBSD 3 - pppd Arbitrary File Permission Modification Race Condition source: https://www.securityfocus.com/bid/5355/info A vulnerability has been reported in some versions of the pppd daemon included with multiple BSD distributions. A race condition error in the...

FreeBSD 4.x / NetBSD 1.4.x/1.5.x/1.6 / OpenBSD 3 - pppd Arbitrary File Permission Modification Race Condition

source: https://www.securityfocus.com/bid/5355/info A vulnerability has been reported in some versions of the pppd daemon included with multiple BSD distributions. A race condition error in the code may result in the pppd process changing the file permissions on an arbitrary system file. pppd wil...

CVE-2002-0557

Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes 1 rexec or 2 rsh to run another user's shell, or 3 atrun to change to a different user's directory, possibly due to memory allocation failures or an incorrect call to authapproval...

CVE-2002-0542

mail in OpenBSD 2.9 and 3.0 processes a tilde escape character in a message even when it is not in interactive mode, which could allow local users to gain root privileges via calls to mail in cron...

OpenBSD 3.1 sshd remote root exploit

Download openssh-3.2.2p1.tar.gz and untar it $ tar -xvzf openssh-3.2.2p1.tar.gz 2. Apply the patch provided below by running: /openssh-3.2.2p1 $ patch pathtodifffile 3. Compile the patched client /openssh-3.2.2p1 $ ./configure && make ssh 4. Run the evil ssh: /openssh-3.2.2p1 $ ./ssh...

Remote buffer overflow in resolver code of libc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ----------------------------------------------------------------------------- Pine Internet Security Advisory ----------------------------------------------------------------------------- Advisory ID : PINE-CERT-20020601 Authors : Joost Pol...

Re: Another flaw in Apache?

Further investigation show that the flaw is not in Apache itself, but in modssl, so it's probably not an OpenBSD-specific bug. It's just not triggered on systems where modssl isn't compiled in. The overflow is the sslcompatdirective function in src/modules/ssl/sslenginecompat.c . -- /- Frank DENI...

Another flaw in Apache?

Hello. While playing with the SetEnv directive with Apache, I noticed that httpd processes are dying with a signal 11 if the data stored in an environment variable was too long. I simply triggered the bug by creating a .htaccess file so a regular user can do it with : SetEnv DATELOCALE "..." The...

Apache 1.x2.0.x - Chunked-Encoding Memory Corruption (1)

Apache 1.x2.0.x - Chunked-Encoding Memory Corruption 1 // source: https://www.securityfocus.com/bid/5033/info When processing requests coded with the 'Chunked Encoding' mechanism, Apache fails to properly calculate required buffer sizes. This is believed to be due to improper signed interpretatio...

CVE-2002-0514

OpenBSD 3.0 PF with the return-rst rule is vulnerable. The RST packet’s TTL is set to 128, allowing remote attackers to infer whether a port is filtered by comparing TTL to the default. Affected component: PF rule handling in OpenBSD 3.0. Root cause: TTL manipulation in RST responses leads to dis...

CVE-2002-0557

OpenBSD 3.0 vulnerability when using NIS/YP with netgroups in the password database can allow rexec or rsh to run another user’s shell, or atrun to switch to a different user’s directory, possibly due to memory allocation failures or an incorrect call to auth_approval(). No remediation details ar...

CVE-2002-0514

PF in OpenBSD 3.0 with the return-rst rule sets the TTL to 128 in the RST packet, which allows remote attackers to determine if a port is being filtered because the TTL is different than the default TTL...

CVE-2002-0557

Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes 1 rexec or 2 rsh to run another user's shell, or 3 atrun to change to a different user's directory, possibly due to memory allocation failures or an incorrect call to authapproval...

PT-2002-1565 · Openbsd · Openbsd

Name of the Vulnerable Software and Affected Versions: OpenBSD version 3.0 Description: The issue allows remote attackers to determine if a port is being filtered due to the TTL being different from the default TTL in the RST packet. This occurs because the PF in OpenBSD 3.0 with the return-rst...

OpenBSD kernel fails to properly check closed file descriptors "0-2" when running setuid program

Overview The OpenBSD kernel does not adequately check file descriptors 0-2 prior to execing setuid binaries. Other OS kernels may be vulnerable as well. Description The OpenBSD kernel does not adequately check file descriptors 0-2 prior to execing setuid binaries. As a result, an attacker may be...

psyBNC 2.3 - Denial of Service

/ psyBNC include include include include include include include include include define SIZE 9000 define PORT 31337 define USER "pr0ix" int senddosint port, int size, char target, char user; int checkvuln...

OpenBSD local DoS and root exploit

The following is research material from FozZy from Hackademy and Hackerz Voice newspaper http://www.hackerzvoice.org, and can be distributed modified or not if proper credits are given to them. For educational purposes only, no warranty of any kind, I may be wrong, this post could kill you mail...