OpenSSH UseLogin option allows remote execution of commands as root

Overview Versions of OpenSSH prior to 2.1.1 current circa June, 2000 allow a remote attacker to execute arbitrary commands with the privileges of sshd, typically root. Description OpenSSH is a free implementation of versions 1 and 2 of the SSH protocol. If sshd is configured with the UseLogin...

MDKSA-2001:079 - problems with devfs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandrake Linux Security Update Advisory Package name: kernel Date: October 8th, 2001 Advisory ID: MDKSA-2001:079 Affected versions: 8.1 Problem Description: Alexander Viro discovered a vulnerability in the devfs implementation that is shipped with...

Apache UserDir Directive Username Enumeration

When configured with the 'UserDir' option, requests to URLs containing a tilde followed by a username will redirect the user to a given subdirectory in the user home. For instance, by default, requesting /root/ displays the HTML contents from /root/publichtml/. If the username requested does not...

CVE-1999-1446

Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located in the Temporary Internet Files and History folders, which are not cleared when the user selects the "Clear History" option, and are not visible when the user browses the folders because of tailored...

CVE-1999-1186

CVE-1999-1186 concerns rxvt (terminal emulator) when compiled with the PRINT_PIPE option on certain Linux distros (e.g., Slackware 3.0, RedHat 2.1). The vulnerability arises from the -print-pipe parameter, which allows a local user to specify a malicious program, potentially gaining root privileg...

CVE-1999-1186

rxvt, when compiled with the PRINTPIPE option in various Linux operating systems including Linux Slackware 3.0 and RedHat 2.1, allows local users to gain root privileges by specifying a malicious program using the -print-pipe command line parameter...

LPRng/rhs-printfilters - remote execution of commands

posted to vendor security ppl, no reply, no patch, so posting here. --begin forwarded message-- RedHat 7.0 possibly others If the lpd is listening on 0.0.0.0 and no access controls are in place, it is possible to execute commands as the lp user, assuming tetex-dvips is installed. From man dvips...

CVE-2001-0428

Cisco VPN 3000 series concentrators before 2.5.2F allow remote attackers to cause a denial of service via an IP packet with an invalid IP option...

CVE-2000-0314

CVE-2000-0314 affects NetBSD 1.3.3 and Linux where traceroute with a large waittime (-w) is not parsed correctly, causing the time delay for sending packets to be zero. This can enable local users to flood other systems. The description covers the affected vectors and impact as stated; no explici...

CVE-2001-0026

rp-pppoe PPPoE client allows remote attackers to cause a denial of service via the Clamp MSS option and a TCP packet with a zero-length TCP option...

CVE-2001-0268

CVE-2001-0268 affects NetBSD 1.5 and earlier and OpenBSD 2.8 and earlier. When the USER_LDT kernel option is enabled, the i386_set_ldt system call does not validate a call gate target, allowing local users to gain root privileges by creating a segment call gate in the Local Descriptor Table whose...

def-2001-09: Winzip32 zipandemail Buffer Overflow

====================================================================== Defcom Labs Advisory def-2001-09 Winzip32 zipandemail Buffer Overflow Author: Peter Grьndl [email protected] Release Date: 2001-03-02 ======================================================================...

Elm 2.5.3 - Alternative-Folder Buffer Overflow

// source: https://www.securityfocus.com/bid/2403/info There is a buffer overflow in elm 2.5 PL3. This overflow is accessible by passing a long string to the -f Alternative-Folder command-line option. This vulnerability may not be restricted to this version of elm. / ------------- elm253-exploit....

OpenBSD 2.6 / 2.7ftpd Remote Exploit

Exploit for bsd platform in category remote exploits ==================================== OpenBSD 2.6 / 2.7ftpd Remote Exploit ==================================== / h0h0h0 0-day k0d3z Exploit by Scrippie, help by dvorak and jimjones greets to sk8 Not fully developt exploit but it works most of t...

AOL Instant Messenger 4.04.1.20104.2.1193 - BuddyIcon Buffer Overflow

AOL Instant Messenger 4.04.1.20104.2.1193 - BuddyIcon Buffer Overflow source: https://www.securityfocus.com/bid/2122/info AOL Instant Messenger AIM is a real time messaging service for users that are on line. When AOL Instant Messenger is installed, by default it configures the system so that the...

AOL Instant Messenger 4.0/4.1.2010/4.2.1193 - BuddyIcon Buffer Overflow

source: https://www.securityfocus.com/bid/2122/info AOL Instant Messenger AIM is a real time messaging service for users that are on line. When AOL Instant Messenger is installed, by default it configures the system so that the aim: URL protocol connects aim:// urls to the AIM client. There exist...

RedHat Linux 7.0 - Roaring Penguin PPPoE Denial of Service

RedHat Linux 7.0 - Roaring Penguin PPPoE Denial of Service source: https://www.securityfocus.com/bid/2098/info Roaring Penguin Software's PPPoE is a freeware PPP over Ethernet client often used by ADSL subscribers running Linux or NetBSD. PPPoE contains a possibly remotely exploitable denial of...

Poll It CGI 2.0 - Multiple Vulnerabilities

Poll It CGI 2.0 - Multiple Vulnerabilities !/usr/bin/perl Poll It CGI v2.0 exploit keelis/havoc korp 2000 shouts to modjo, p, zen, kd, ab, all the script kiddies. keelisathushmaildotcom use Socket; $host, $cgiloc = @ARGV0,1; $ip=inetaton$host; print"\n\t+--- Poll It CGI v2.0 exploit ---+";...

Poll It CGI 2.0 - Multiple Vulnerabilities

!/usr/bin/perl Poll It CGI v2.0 exploit keelis/havoc korp 2000 shouts to modjo, p, zen, kd, ab, all the script kiddies. keelisathushmaildotcom use Socket; $host, $cgiloc = @ARGV0,1; $ip=inetaton$host; print"\n\t+--- Poll It CGI v2.0 exploit ---+"; print"\n\t+--- keelis/havoc korp 2000 ---+\n\n\n"...

hp-ux.cu.overflow.txt

======================================================= HPUX cu -l option buffer overflow vulnerability ======================================================= Date: 02/11/2000 Tested on HP-UX B.11.00 $ ls -la which cu -r-sr-xr-x 1 bin 40960 9 avr 1998 /bin/cu Using '-l' with a long option string...