Redhat Stronghold status / info Request Information Disclosure

Redhat Stronghold Secure Server File System Disclosure Vulnerability The problem: In Redhat Stronghold from versions 2.3 up to 3.0 a flaw exists that allows a remote attacker to disclose sensitive system files including the httpd.conf file, if a restricted access to the server status report is no...

Утечка информации в Redhat Stronghold (information leakage)

Файлы stronghold-info и stronghold-status доступные через Web содержат важную информацию о системе...

Redhat Stronghold Secure Server File System Disclosure Vulnerabil ity

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Redhat Stronghold Secure Server File System Disclosure Vulnerability Advisory Code: VIGILANTE-2001002 Release Date: November 23, 2001 Systems affected: Stronghold/3.0 Apache/1.3.19 RedHat/3014 Unix PHP/3.0.18 modssl/2.8.1 OpenSSL/0.9.6 modperl/1.25...

RH Linux Tux HTTPD DoS

TUX HTTPD Denial of Service Condition ============================= Background: ------------- Tux is a Kernel-Space HTTP server coded for optimal performance IRQ Affinity,HTTP compression, direct scatter-gather DMA etc. It is meant to be used as the main HTTP server for static objects with reques...

samba.sh

/bin/sh Samba =2.0.7 xploit for RH 5.1-7.0 by MostaraCaka Snyggast @2001, mail: [email protected] Tested on RH 7.0 with no updates Use it wisely and make the Net more secure Author is not responsible for any illegal usage of this script Knowledge is power, and power is knowledge.../by...

squid DoS

Dear All, I'd like to inform about a DoS bug I recently found in SQUID regarding handling of mkdir-only PUT requests - please look at http://www.squid-cache.org/bugs/showbug.cgi?id=233 for more info. From my testing, it applies both to Squid 2.3 and 2.4 series. Tested on RedHat 6.2 and 7.1. This...

CVE-1999-1186

CVE-1999-1186 concerns rxvt (terminal emulator) when compiled with the PRINT_PIPE option on certain Linux distros (e.g., Slackware 3.0, RedHat 2.1). The vulnerability arises from the -print-pipe parameter, which allows a local user to specify a malicious program, potentially gaining root privileg...

LPRng/rhs-printfilters - remote execution of commands

posted to vendor security ppl, no reply, no patch, so posting here. --begin forwarded message-- RedHat 7.0 possibly others If the lpd is listening on 0.0.0.0 and no access controls are in place, it is possible to execute commands as the lp user, assuming tetex-dvips is installed. From man dvips...

RedHat 6.27.07.1 Lpd - Remote Command Execution via DVI Printfilter Configuration Error

RedHat 6.27.07.1 Lpd - Remote Command Execution via DVI Printfilter Configuration Error source: https://www.securityfocus.com/bid/3241/info 'dvips' is a utility that converts DVI documents to PostScript. It is an optional component of the TeTeX text formatting package. When installed on a system...

RedHat 6.2/7.0/7.1 Lpd - Remote Command Execution via DVI Printfilter Configuration Error

source: https://www.securityfocus.com/bid/3241/info 'dvips' is a utility that converts DVI documents to PostScript. It is an optional component of the TeTeX text formatting package. When installed on a system where LPRnG and TeTeX are in use, 'dvips' will be invoked by 'lpd' when a DVI document i...

JWSDK *add-on

Javaserver Web Dev Kit version 1.0 JWSDK JWSDK directory traversal vulnerability is found by CHINANSL Security AdvisoryCSA-200106, i want to add another thing, it's also vulnerable to other operating system like redhat 6.1 and this nasty bug allows you to browse and read any file with ROOT...

RH 7.0 Crontab exploit - apparently fixed

/ Crontab tmp file race condition http://bugzilla.redhat.com/bugzilla/showbug.cgi?id=37771 Apparently this is fixed. Wonder why it still works. Local exploit Quick and dirty exploit for crontab insecure tmp files Redhat 7.0 - kept up2date with up2date Checked Tue Jun 26 00:15:32 NZST 2001...

LPRng + tetex tmpfile race - uid lp exploit

If the tetex package and LPRng are installed, there is an exploitable race condition with a tmp file that allows elevation of privs. It's fixed in rawhide, but that doesn't really help people who just use the provided up2date program to keep themselves secure. / Redhat 7.0 LPRng-3.7.4-23 and...

expect to get hacked

====================== expect to get hacked ====================== After looking at a recent discussion on vuln-dev, I decided that this might as well be released again. Makes the process of exploiting expect a little rpm -qf which expect expect-5.31-46 Under Redhat 7.0 expect uses the wrong path...

man 1.5h10 + man 1.5i-4 exploits

This advisory is also stored, along with the exploits at http://generic.labs.pulltheplug.com/zen/ as man.txt ====================================================================== Local root from /usr/bin/man + /etc/cron.daily/makewhatis.cron Redhat 7.0 Redhat 7.1 on other distributions it may al...

XFree86-xfs-4.0.1-1 DoS

Hello, xfs from the package XFree86-xfs-4.0.1-1 i386.rpm, RedHat 7.0 seems to suffer from a Denial of Service attack. To cause xfs to stop responding for requests, try to do the fillowing: $ telnet victim xfs /dev/urandom Repeat about 100 or 1000 times and you get Connection refused message...

LPRng 3.6.x - Failure To Drop Supplementary Groups

LPRng 3.6.x - Failure To Drop Supplementary Groups / source: https://www.securityfocus.com/bid/2865/info The LPRng software is an enhanced, extended, and portable implementation of the Berkeley LPR print spooler functionality. When the LPRng daemon is initialized, it fails to drop its supplementa...

RedHat 6.16.27.07.1 - Man Cache File Creation

RedHat 6.16.27.07.1 - Man Cache File Creation source: https://www.securityfocus.com/bid/2815/info A vulnerability exists in the 'man' system manual pager program. It is possible for local users to cause man to cache files in the system cache directory from outside of the configured manual page...

RedHat 6.1/6.2/7.0/7.1 - Man Cache File Creation

source: https://www.securityfocus.com/bid/2815/info A vulnerability exists in the 'man' system manual pager program. It is possible for local users to cause man to cache files in the system cache directory from outside of the configured manual page hierarchy search path. Combined with the...

RH7.0: man local gid 15 (man) exploit

======================================================== Vulnerable systems: redhat 7.0 with man-1.5h1-10 default package and earlier. ========================================================= Heap Based Overflow of man via -S option gives GID man. Due to a slight error in a length check, the -S...