SSHD-Poison - A Tool To Get Creds Of Pam Based SSHD Authentication

sshd-poison is a tool to get creds of pam based sshd authentication, this is not the easiest way to do that you can create a pam module, or just add auth optional pamexec.so quiet exposeauthtok /bin/bash -c read,-r,x;echo,-e,"env\n$x"somefile in a service configuration, not even the stealthiest t...

kernel security update

kernel 2.6.18-419.0.0.0.5 - fs fix kernel panic on boot on ia64 guests Honglei Wang orabug 26934100 2.6.18-419.0.0.0.4 - fs fix bug in loading of PIE binaries Michael Davidson orabug 26916951 CVE-2017-1000253...

Oracle Linux 6 : kernel (ELSA-2017-2863)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2863 advisory. - net l2cap: prevent stack overflow on incoming bluetooth packet Neil Horman 1490060 1490062 CVE-2017-1000251 - fs binfmtelf.c:loadelfbinary: return -EINVAL on...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3626)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3626 advisory. 2.6.39-400.297.9 - fs/binfmtelf.c: fix bug in loading of PIE binaries Michael Davidson Orabug: 26870958 CVE-2017-1000253 Tenable has extracted the preceding...

Unbreakable Enterprise kernel security update

2.6.39-400.297.9 - fs/binfmtelf.c: fix bug in loading of PIE binaries Michael Davidson Orabug: 26870958 CVE-2017-1000253...

kernel: load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary

A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable PIE, the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory...

kernel: proc: protect mm start_code/end_code in /proc/pid/stat

The dotaskstat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the startcode and endcode fields in the /proc//stat file for a process executing a PIE...