2175 matches found
Nvidia (nvsvc) Display Driver Service Local Privilege Escalation
The named pipe, \pipe\nsvr, has a NULL DACL allowing any authenticated user to interact with the service. It contains a stacked based buffer overflow as a result of a memmove operation. Note the slight spelling differences: the executable is 'nvvsvc.exe', the service name is 'nvsvc', and the name...
Updated torque packages fix CVE-2013-4495
Updated torque packages fix security vulnerability: A user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these commands to be executed as root on the pbsserver CVE-2013-4495...
[SECURITY] [DSA 2796-1] torque security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2796-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso November 13, 2013 http://www.debian.org/security/faq -...
Agnitum Outpost Internet Security Local Privilege Escalation
This module exploits a directory traversal vulnerability on Agnitum Outpost Internet Security 8.1. The vulnerability exists in the acs.exe component, allowing the user to load arbitrary DLLs through the acsipcserver named pipe, and finally execute arbitrary code with SYSTEM privileges. This modul...
Design/Logic Flaw
The fillpipeinfo function in bsd/kern/syspipe.c in the XNU kernel in Apple Mac OS X 10.8.x allows local users to defeat the KASLR protection mechanism via the PROCPIDFDPIPEINFO option to the procinfo system call for a kernel pipe handle...
Dovecot with Exim sender_address Parameter - Remote Command Execution
Exploit for linux platform in category remote exploits Exim with Dovecot: Typical Misconfiguration Leads to Remote Command Execution During a penetration test a typical misconfiguration was found in the way Dovecot is used as a local delivery agent by Exim. A common use case for the Dovecot IMAP...
Exim / Dovecot Command Execution
Advisory: Exim with Dovecot: Typical Misconfiguration Leads to Remote Command Execution During a penetration test a typical misconfiguration was found in the way Dovecot is used as a local delivery agent by Exim. A common use case for the Dovecot IMAP and POP3 server is the use of Dovecot as a...
Ruby Gem Curl Command Execution
Curl Ruby Gem Remote command execution 3/12/2013 https://github.com/tg0/curl Specially crafted URLs can result in remote code execution: In ./lib/curl.rb the following lines: 131 cmd = "curl cookiesstore browsertype @setupparams ref "url" " 132 if @debug 133 puts cmd.red 134 end 135 result =...
NVidia Display Driver Service (Nsvr) Exploit
Exploit for windows platform in category local exploits / NVidia Display Driver Service Nsvr Exploit - Christmas 2012 - Bypass DEP + ASLR + /GS + CoE ============================================================= @peterwintrsmith Initial release 25/12/12 Update 25/12/12 - Target for 30 Aug 2012...
Nvidia Display Driver Service (Nsvr) - Local Buffer Overflow
Nvidia Display Driver Service Nsvr - Local Buffer Overflow / NVidia Display Driver Service Nsvr Exploit - Christmas 2012 - Bypass DEP + ASLR + /GS + CoE ============================================================= @peterwintrsmith Initial release 25/12/12 Update 25/12/12 - Target for 30 Aug 2012...
Researcher Who Found Nvidia Bug Confirms Security Update Clears Up Driver Zero Day
Nvidia has released a new driver for its graphics cards that includes a security update for a zero-day vulnerability in the Nvidia Display Driver Service that came to light on Christmas day. UK researcher Peter Winter-Smith posted vulnerability details and an exploit to Pastebin describing a stac...
NVidia Display Driver Buffer Overflow
/ NVidia Display Driver Service Nsvr Exploit - Christmas 2012 - Bypass DEP + ASLR + /GS + CoE ============================================================= @peterwintrsmith Hey all! Here is an exploit for an interesting stack buffer overflow in the NVidia Display Driver Service. The service liste...
Reaver Pro - Local Privilege Escalation
Reaver Pro - Local Privilege Escalation source: https://www.securityfocus.com/bid/55725/info Reaver Pro is prone to a local privilege-escalation vulnerability. A local attacker may exploit this issue to execute arbitrary code with root privileges. Successful exploits may result in the complete...
Reaver Pro - Local Privilege Escalation
source: https://www.securityfocus.com/bid/55725/info Reaver Pro is prone to a local privilege-escalation vulnerability. A local attacker may exploit this issue to execute arbitrary code with root privileges. Successful exploits may result in the complete compromise of affected computers...
Reaver Pro Livedisc Code Execution
!/usr/bin/env python import os print """ Reaver Pro Local Root Exploits a hilarious named pipe flaw. The named pipe /tmp/exe is open to anyone... Any command echoed into it gets ran as root. This simply launches a bindshell on 4444... Insecurety Research | insecurety.net """ print "" print "This ...
Scientific Linux Security Update : bash on SL5.x i386/x86_64
Bash is the default shell for Scientific Linux. It was found that certain scripts bundled with the Bash documentation created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary fil...
CentOS Update for bash CESA-2011:1073 centos5 x86_64
Check for the Version of bash OpenVAS Vulnerability Test CentOS Update for bash CESA-2011:1073 centos5 x8664 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...
kernel: cifs: dentry refcount leak when opening a FIFO on lookup leads to panic on unmount
The cifslookup function in fs/cifs/dir.c in the Linux kernel before 3.2.10 allows local users to cause a denial of service OOPS via attempted access to a special file, as demonstrated by a FIFO...
Linux Kernel epoll Subsystem “eventpoll.c”多个本地拒绝服务漏洞
BUGTRAQ ID: 46630 CVE ID: CVE-2011-1082,CVE-2011-1083 Linux Kernel是Linux操作系统的内核。 Linux Kernel 2.6.38之前版本的fs/eventpoll.c在epoll子系统的实现上存在本地拒绝服务安全漏洞，将epoll文件描述符放置在其他epoll数据结构中，没有检查已关闭的循环或深链接，攻击者可利用此漏洞造成拒绝服务 0 Linux kernel 2.6.38 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.or...
