WvTFTPd 0.9 Remote Root Heap Overflow Exploit

Exploit for linux platform in category remote exploits ============================================= WvTFTPd 0.9 Remote Root Heap Overflow Exploit ============================================= / wvtftp option name heap overflow remote root exploit infamous42md AT hotpop DOT com exploitation is no...

wvtfpd remote root heap overflow

Subject: WVTFTPD heap overflow, remote root exploit ++++++++++++++++++++++++++++++++++++++++++++ Product: WVTFTPD ... the world's fastest TFTP server. http://open.nit.ca/wiki/index.php?page=WvTftp Not used much yet b/c it's rather new, but other software by this company seems to be in circulation...

SCO OpenServer 5.0.7 - MMDF deliver Privilege Escalation

/ MMDF deliver local root exploit for SCO OpenServer 5.0.7 x86 Copyright 2004 Ramon de Carvalho Valle / char shellcode= / 36 bytes / "\x68\xff\xf8\xff\x3c" / pushl $0x3cfff8ff / "\x6a\x65" / pushl $0x65 / "\x89\xe6" / movl %esp,%esi / "\xf7\x56\x04" / notl 0x04%esi / "\xf6\x16" / notb %esi /...

SCO Openserver 5.0.7 (MMDF deliver) Local Root Exploit

Exploit for sco platform in category local exploits ====================================================== SCO Openserver 5.0.7 MMDF deliver Local Root Exploit ====================================================== / MMDF deliver local root exploit for SCO OpenServer 5.0.7 x86 Copyright 2004 Ramo...

SCO OpenServer 5.0.7 - MMDF deliver Privilege Escalation

SCO OpenServer 5.0.7 - MMDF deliver Privilege Escalation / MMDF deliver local root exploit for SCO OpenServer 5.0.7 x86 Copyright 2004 Ramon de Carvalho Valle / char shellcode= / 36 bytes / "\x68\xff\xf8\xff\x3c" / pushl $0x3cfff8ff / "\x6a\x65" / pushl $0x65 / "\x89\xe6" / movl %esp,%esi /...

Monit <= 4.2 Basic Authentication Remote Root Exploit

No description provided by source. / THE EYE ON SECURITY RESEARCH GROUP - INDIA http://www.eos-india.net/poc/305monit.c Remote Root Exploit for Monit = 4.2 Vulnerability: Buffer overflow in handling of Basic Authentication informations. Server authenticates clients through: Authentication: Basic...

Debian DSA-087-1 : wu-ftpd - remote root exploit

CORE ST reports that an exploit has been found for a bug in the wu-ftpd glob code this is the code that handles filename wildcard expansion. Any logged in user including anonymous FTP users can exploit the bug to gain root privileges on the server. %NASLMINLEVEL 70300 C Tenable Network Security,...

Debian DSA-403-1 : kernel-image-2.4.18-1-alpha, kernel-image-2.4.18-1-i386, kernel-source-2.4.18 - local root exploit

Recently multiple servers of the Debian project were compromised using a Debian developers account and an unknown root exploit. Forensics revealed a burneye encrypted exploit. Robert van der Meulen managed to decrypt the binary which revealed a kernel exploit. Study of the exploit by the Red Hat...

Debian DSA-092-1 : wmtv - local root exploit

Nicolas Boullis found a nasty security problem in the wmtv a dockable video4linux TV player for windowmaker package as distributed in Debian GNU/Linux 2.2. wmtv can optionally run a command if you double-click on the TV window. This command can be specified using the -e command line option...

Debian DSA-189-1 : luxman - local root exploit

iDEFENSE reported about a vulnerability in LuxMan, a maze game for GNU/Linux, similar to the PacMan arcade game. When successfully exploited a local attacker gains read-write access to the memory, leading to a local root compromise in many ways, examples of which include scanning the file for...

Debian DSA-357-1 : wu-ftpd - remote root exploit

iSEC Security Research reports that wu-ftpd contains an off-by-one bug in the fbrealpath function which could be exploited by a logged-in user local or anonymous to gain root privileges. A demonstration exploit is reportedly available. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-454-1 : linux-kernel-2.2.22-alpha - failing function and TLB flush

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to flushing the TLB Translation Lookaside Buffer, an address cache too early it is possible for an attacker to trigger a local...

Debian DSA-119-1 : ssh -- local root exploit, remote client exploit

Joost Pol reports that OpenSSH versions 2.0 through 3.0.2 have an off-by-one bug in the channel allocation code. This vulnerability can be exploited by authenticated users to gain root privilege or by a malicious server exploiting a client with this bug. %NASLMINLEVEL 999999 @DEPRECATED@ This...

Debian DSA-101-1 : sudo - Local root exploit

Sebastian Krahmer from SuSE found a vulnerability in sudo which could easily lead into a local root exploit. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-101. The text itself is copyrig...

Debian DSA-155-1 : kdelibs - privacy escalation with Konqueror

Due to a security engineering oversight, the SSL library from KDE, which Konqueror uses, doesn't check whether an intermediate certificate for a connection is signed by the certificate authority as safe for the purpose, but accepts it when it is signed. This makes it possible for anyone with a...

Debian DSA-466-1 : linux-kernel-2.2.10-powerpc-apus - failing function and TLB flush

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to flushing the TLB Translation Lookaside Buffer, an address cache too early it is possible for an attacker to trigger a local...

Debian DSA-054-1 : cron - local root exploit

A recent fall 2000 security fix to cron introduced an error in giving up privileges before invoking the editor. This was discovered by Sebastian Krahmer from SuSE. A malicious user could easily gain root access. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-456-1 : linux-kernel-2.2.19-arm - failing function and TLB flush

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to flushing the TLB Translation Lookaside Buffer, an address cache too early it is possible for an attacker to trigger a local...

Debian DSA-514-1 : kernel-image-sparc-2.2 - failing function and TLB flush

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to flushing the TLB Translation Lookaside Buffer, an address cache too early it is possible for an attacker to trigger a local...

Debian DSA-453-1 : linux-kernel-2.2.20-i386+m68k+powerpc - failing function and TLB flush

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to flushing the TLB Translation Lookaside Buffer, an address cache too early it is possible for an attacker to trigger a local...