Linux each version of the local root password cracking method-vulnerability warning-the black bar safety net

This time the old met was asked and the various linux versions of the local root password cracking method, I here own and on the network to collect some information, we want to see this article and just used to give the art a little help: A RedHat/CentOS/Fedora system password cracking 1. In the...

No-IP DUC 2.1.7 - Remote Code Execution

No-IP DUC 2.1.7 - Remote Code Execution / | |/ / / |/ / / / | / / / / /|/ / / / / / / / / / / / / // / / / / // / // // / //|// //// //,//,/ xenomuta arroba phreaker punto net http://xenomuta.tuxfamily.org/ - Methylxantina 256mg Permlink: http://xenomuta.tuxfamily.org/exploits/noIPwn3r.c...

Linux Kernel VDSO本地权限提升漏洞

BUGTRAQ ID: 32099 CVECAN ID: CVE-2008-3527 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的arch/i386/kernel/sysenter.c没有正确地实现虚拟动态共享对象（vDSO），本地攻击者可以通过调用installspecialmapping、syscall和syscall32nopage函数获得权限提升或导致拒绝服务。 Linux kernel 2.6.x Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Sudo <= 1.6.9p18 (Defaults setenv) Local Privilege Escalation Exploit

No description provided by source. !/bin/sh Sudo = 1.6.9p18 local r00t exploit by Kingcope/2008/www.com-winner.com Most lame exploit EVER! Needs a special configuration in the sudoers file: --- "Defaults setenv" so environ vars are preserved : --- May also need the current users password to be...

Sudo 1.6.9p18 - Defaults SetEnv Local Privilege Escalation

Sudo 1.6.9p18 - Defaults SetEnv Local Privilege Escalation !/bin/sh Sudo "Defaults setenv" so environ vars are preserved : program.c include include include void init if !geteuid unsetenv"LDPRELOAD"; setgid0; setuid0; execl"/bin/sh","sh","-c","chown 0:0 /tmp/xxxx; /bin/chmod +xs /tmp/xxxx",NULL;...

Sudo 1.6.9p18 - 'Defaults SetEnv' Local Privilege Escalation

!/bin/sh Sudo "Defaults setenv" so environ vars are preserved : program.c include include include void init if !geteuid unsetenv"LDPRELOAD"; setgid0; setuid0; execl"/bin/sh","sh","-c","chown 0:0 /tmp/xxxx; /bin/chmod +xs /tmp/xxxx",NULL; EOF cat xxxx.c EOF int mainvoid setgid0; setuid0; //...

Sudo <= 1.6.9p18 (Defaults setenv) Local Privilege Escalation Exploit

Exploit for multiple platform in category local exploits ===================================================================== Sudo "Defaults setenv" so environ vars are preserved : program.c include include include void init if !geteuid unsetenv"LDPRELOAD"; setgid0; setuid0;...

Linux Kernel VDSO未明特权提升漏洞

BUGTRAQ ID: 32099 CVE ID：CVE-2008-3527 CNCVE ID：CNCVE-20083527 Linux是一款开放源代码的操作系统。 Linux虚拟动态共享对象vDSO实现存在边界检查错误，本地攻击者可以利用漏洞对系统进行拒绝服务攻击或提升特权。 目前没有详细漏洞细节提供。 RedHat Enterprise Linux Desktop 5 client RedHat Enterprise Linux 5 server Linux kernel 2.6.19 1 Linux kernel 2.6.19 .2 Linux kernel 2.6.19 .1...

Adobe Flash Player剪贴板劫持漏洞

BUGTRAQ ID: 31117 CVECAN ID: CVE-2008-3873 Flash Player是一款非常流行的FLASH播放器。 Adobe Flash Player中ActionScript的System.setClipboard方式允许向剪贴板中添加URL，恶意的SWF文件可能向剪贴板添加URL，导致用户错在不知情的情况下加载攻击者控制的URL。 Adobe Flash Player 9.0.124.0 Adobe ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Adobe Flash Player FileReference API任意文件上传/下载漏洞

CVECAN ID: CVE-2008-4401 Flash Player是一款非常流行的FLASH播放器。 Adobe Flash Player中的ActionScript对FileReference上传API的FileReference.browse操作或FileReference下载API的FileReference.download操作没有要求用户交互，用户可能在不知情的情况下上传或下载恶意文件 Adobe Flash Player 9.0.124.0 Adobe ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Lynx '.mailcap'和'.mime.type'文件本地代码执行漏洞

BUGTRAQ ID: 31917 CVE ID：CVE-2006-7234 CNCVE ID：CNCVE-20087234 Lynx是一款基于文本的浏览器。 Lynx处理'.mailcap'和'.mime.type'文件存在问题，本地攻击者可以利用漏洞以应用程序权限执行任意指令。 Lynx从当前目录中打开mailcap和mime类型定义文件，如果用户可以在特殊构建的目录中诱使用户运行lynx，攻击者可以控制目录以运行lynx用户权限执行任意代码。 University of Kansas Lynx 2.8.6 dev9 University of Kansas Lynx 2.8.6...

Linux Kernel 'do_splice_from()'本地安全绕过漏洞

BUGTRAQ ID: 31903 CVE ID：CVE-2008-4554 CNCVE ID：CNCVE-20084554 Linux是一款开放源代码的操作系统。 Linux在执行部分文件操作时'dosplicefrom'函数不正确拒绝文件描述符，本地攻击者可以利用漏洞绕过本地安全限制。 攻击者可以绕过append-only限制，破坏系统文件。 RedHat Fedora 9 0 RedHat Fedora 8 0 Linux kernel 2.6.26 4 Linux kernel 2.6.26 3 Linux kernel 2.6.26 .6 Linux kernel 2.6.26...

Apache Tomcat 'RemoteFilterValve'安全绕过漏洞

BUGTRAQ ID: 31698 CVE ID：CVE-2008-3271 CNCVE ID：CNCVE-20083271 Apache Tomcat是一款流行的开放源码的JSP应用服务器程序。 Apache Tomcat处理'RemoteFilterValve'扩展存在安全绕过问题，远程攻击者可以利用漏洞绕过访问限制，获得敏感信息。 在使用RemoteAddrValve允许部分地址访问引擎时： Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="a.b.c.d"/...

Linux kernel 'fs/direct-io.c'本地拒绝服务漏洞

BUGTRAQ ID:31515 CVE ID：CVE-2007-6716 CNCVE ID：CNCVE-20086716 Linux是一款开放源代码的操作系统。 Linux内核Direct-IO实现存在一个缺陷，本地攻击者可以利用漏洞进行拒绝服务攻击。 dio-mapbh.bbdev没有通过directioworker初始化，在dodirectIO处理中，diogetpage会返回EFAULT，引起之后的代码不能初始化dio-mapbh，并直接返回错误。但是在directioworker中没有处理这个错误。 S.u.S.E. SLE SDK 9 S.u.S.E...

Linux Kernel 'generic_file_splice_write()' Local Privilege Escalation Vulnerabil

The Linux kernel is prone to a local privilege-escalation vulnerability related to the 'genericfilesplicewrite' function. Local attackers can exploit this issue to gain superuser privileges. Successful exploits will result in the complete compromise of the computer. Versions prior to Linux kernel...

Linux Kernel UBIFS Orphan Inode Local Denial of Service Vulnerability

CVE: CVE-2008-3275 The Linux kernel is prone to a local denial-of-service vulnerability affecting the VFS behavior in UBIFS UBI File System. Attackers can exploit this issue to cause the kernel to crash, denying service to legitimate users. Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux...

Linux Kernel 'do_change_type()' Local Security Bypass Vulnerability

The Linux kernel is prone to a local security-bypass vulnerability because the 'dochangetype' routine fails to adequately verify user permissions before performing mountpoint type changes. Attackers can exploit this issue to bypass security restrictions and change mountpoint types. Attackers coul...

Linux Kernel 'snd_seq_oss_synth_make_info()' Information Disclosure Vulnerability

CVE: CVE-2008-3272 The Linux kernel is prone to an information-disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Versions prior to Linux kernel 2.6.27-rc2 are vulnerable. Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu...

Fedora 8/9 Linux Kernel 'utrace_control' NULL Pointer Dereference Denial of Service Vulnerability

CVE: CVE-2008-3832 Fedora 8 and 9 Linux kernel is prone to a local denial-of-service vulnerability. Attackers can exploit this issue to crash the affected kernel, denying service to legitimate users. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this ha...

Mozilla Firefox/SeaMonkey UTF-8基于栈的缓冲区溢出漏洞

BUGTRAQ ID: 31397 CVE ID：CVE-2008-0016 CNCVE ID：CNCVE-20080016 Mozilla Firefox/SeaMonkey是一款开放源代码的WEB浏览器和WEB应用套件。 Mozilla Firefox/SeaMonkey处理UTF-8 URL存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 Mozilla...