[SECURITY] [DSA 735-2] New sudo packages fix pathname validation race

------------------------------------------------------------------------ Debian Security Advisory DSA 735-2 [email protected] http://www.debian.org/security/ Michael Stone July 07, 2005 http://www.debian.org/security/faq - ------------------------------------------------------------------------...

DSA-735-2 sudo - pathname validation race

Bulletin has no description...

Debian DSA-735-1 : sudo - pathname validation race

A local user who has been granted permission to run commands via sudo could run arbitrary commands as a privileged user due to a flaw in sudo's pathname validation. This bug only affects configurations which have restricted user configurations prior to an ALL directive in the configuration file. ...

[SECURITY] [DSA 735-1] New sudo packages fix pathname validation race

------------------------------------------------------------------------ Debian Security Advisory 735-1 [email protected] http://www.debian.org/security/ Michael Stone July 01, 2005 http://www.debian.org/security/faq - ------------------------------------------------------------------------...

DSA-735-1 sudo - pathname validation race

Bulletin has no description...

Servers Alive: Local Privilege Escalation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory information: Title: Servers Alive - Privilege Escalation CVE Candidate Number: CAN-2005-0352 Application: Servers Alive Versions known affected: 4.1, 5.0; other versions not tested. Classification: Privilege Escalation Author: Michael Starks...

AdobeMac.txt

Note: Sorry if this is a dupe, I might of sent it to the wrong address. Local root exploit on Mac OS X 10.3.6 with Adobe products installed Found by Jonathan Bringhurst Summary: It's possible to create a suid root shell with a non-privileged user on a Mac OS X 10.3.6 system with Adobe Version Cue...

GLSA-200407-10 : rsync: Directory traversal in rsync daemon

The remote host is affected by the vulnerability described in GLSA-200407-10 rsync: Directory traversal in rsync daemon When rsyncd is used without chroot 'use chroot = false' in the rsyncd.conf file, the paths sent by the client are not checked thoroughly enough. If rsyncd is used with read-writ...

VapidSAP.txt

Vapid Labs SAP database local root vulnerability during installation. December 10, 2002 I. BACKGROUND SAP DB is a Free Enterprise database http://www.sapdb.org. An exploitable race condition exists during installation that can be won to yield root to a local malicous user. An executable is world...

Frisk F-Prot AntiVirus 3.12b - Command Line Scanner Buffer Overflow

Frisk F-Prot AntiVirus 3.12b - Command Line Scanner Buffer Overflow source: https://www.securityfocus.com/bid/6969/info Frisk's F-Prot Antivirus for Linux and BSD is prone to a buffer overflow in file name parameters that are passed to the command line scanner. If a backup script is launched by a...

Frisk F-Prot AntiVirus 3.12b - Command Line Scanner Buffer Overflow

source: https://www.securityfocus.com/bid/6969/info Frisk's F-Prot Antivirus for Linux and BSD is prone to a buffer overflow in file name parameters that are passed to the command line scanner. If a backup script is launched by a privileged user to scan the filesystem scans a file with an unusual...

Arbitrary Command Execution on Distributor SQL Server 2000 machines (#NISR22002002A)

NGSSoftware Insight Security Research Advisory Name: Arbitrary Command Execution on SQL Server 2000 Systems: Microsoft SQL Server 2000 SP 2 Severity: High Risk for Distributor servers Category: Arbitrary Command Execution Vendor URL: http://www.microsoft.com/ Author: David Litchfield...

Microsoft SQL 2000/7.0 - Agent Jobs Privilege Escalation

source: https://www.securityfocus.com/bid/5483/info Microsoft SQL Server 2000 uses an Agent which is responsible for restarting the SQL Server service, replication, and running scheduled jobs. Some of the jobs that the Agent executes have weak permissions, which could allow a user with low...

FreeBSD 4.x NetBSD 1.4.x1.5.x1.6 OpenBSD 3 - pppd Arbitrary File Permission Modification Race Condition

FreeBSD 4.x NetBSD 1.4.x1.5.x1.6 OpenBSD 3 - pppd Arbitrary File Permission Modification Race Condition source: https://www.securityfocus.com/bid/5355/info A vulnerability has been reported in some versions of the pppd daemon included with multiple BSD distributions. A race condition error in the...

Linux Kernel 2.4.18/2.4.19 - Privileged File Descriptor Resource Exhaustion (Denial of Service)

/ source: https://www.securityfocus.com/bid/5178/info The Linux kernel is a freely available, open source kernel originally written by Linus Torvalds. It is the core of all Linux distributions. Recent versions of the Linux kernel include a collection of file descriptors which are reserved for usa...

FreeBSD-SA-01:62.uucp

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:62 Security Advisory FreeBSD, Inc. Topic: UUCP allows local root exploit Category: core Module: uucp Announced: 2001-10-08 Credits: [email protected] Affects: All release...

SpeechD 0.10.2 - Privileged Command Execution

SpeechD 0.10.2 - Privileged Command Execution source: https://www.securityfocus.com/bid/3326/info SpeechD is a device-independent layer for speech synthesis under Linux, providing an interface for speech-based applications or device drivers. SpeechD has been found to contain a flaw under certain...

Midnight Commander

The Midnight Commander 4.5.51 latest. $ od -t x1 mcbug 0000000 03 14 77 04 0a $ mkdir cat mcbug $ mc try to view this directory - 'w' - 0x77 command will be executed; longer commands might be used, as well Obviously, this attack requires privledged user interaction. Midnight Commander won't displ...

Slackware Linux - '/usr/bin/ppp-off' Insecure /tmp Call

!/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp. Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any fileie: /etc/issue, thus when root runs the ppp-off script, the output of 'ps x' woul...

OpenBSD Exploit

HP2 advisory HP2 advisory HP2 advisory HP2 advisory HP2 advisory - | | | www.hackphreak.org | | | | Version : Hackphreak advisory 2 of many | | Author : RLoxleyhackphreak / condemnation / EHAP / RSH / ZSH soon| | Contributed : All of Team Hackphreak thanks alot & SSG | | Topic : A non-privledged...