security flaw

Unspecified vulnerability in the sctpmakeabortuser function in the SCTP implementation in Linux 2.6.x before 2.6.17.10 and 2.4.23 up to 2.4.33 allows local users to cause a denial of service panic and possibly gain root privileges via unknown attack vectors...

rPSA-2006-0082-1 vixie-cron

rPath Security Advisory: 2006-0082-1 Published: 2006-05-25 Products: rPath Linux 1 Rating: Critical Exposure Level Classification: Local Root Deterministic Privilege Escalation Updated Versions: vixie-cron=/conary.rpath.com@rpl:devel//1/4.1-5.2-1 References:...

CVE-2006-2607

CVE-2006-2607 refers to a local privilege escalation in vixie-cron 4.1 where do_command.c does not check the return value of setuid(), potentially allowing a root gain if setuid() fails (e.g., PAM limits or resource limits). Connected advisories confirm this vulnerability and document patches/ups...

NSFOCUS SA2006-02 : IBM AIX mklvcopy Local Privilege Escalation Vulnerability

NSFOCUS Security Advisory SA2006-02 IBM AIX mklvcopy Local Privilege Escalation Vulnerability Release Date: 2006-04-24 CVE ID: CVE-2006-1246 http://www.nsfocus.com/english/homepage/research/0602.htm Affected systems & software =================== IBM AIX 5.3 Unaffected systems & software...

CVE-2006-1656

vserver in util-vserver 0.30.209 executes a command as root when the suexec userid parameter is invalid and non-numeric, which might cause local users to inadvertently execute dangerous commands as root...

Ubuntu 4.10 : linux-source-2.6.8.1 vulnerability (USN-39-1)

USN-30-1 fixed several flaws in the Linux ELF binary loader's handling of setuid binaries. Unfortunately it was found that these patches were not sufficient to prevent all possible attacks on 64-bit platforms, so previous amd64 kernel images were still vulnerable to root privilege escalation if...

CVE-2005-3784

CVE-2005-3784 concerns the Linux kernel 2.6.x series: auto-reap of child processes can include ptrace-attached children, causing a dangling ptrace reference that leads to local denial of service (crash) and potential root privileges. The description specifies the vulnerable condition is present i...

Linux Kernel 2.4/2.6 bluez Local Root Privilege Escalation Exploit (update)

Exploit for linux platform in category local exploits =========================================================================== Linux Kernel 2.4/2.6 bluez Local Root Privilege Escalation Exploit update =========================================================================== / Due to many...

XMail 1.21 (-t Command Line Option) Local Root Buffer Overflow Exploit

No description provided by source. / XMail 1.21 'sendmail' local exploit ret-into-libc Yields uid root || gid mail By qaaz at centrum dot cz, 2005 / include stdio.h include stdlib.h include unistd.h include string.h include signal.h include sys/types.h include sys/wait.h include sys/select.h defi...

ppxp -- local root exploit

A Debian Advisory reports: Jens Steube discovered that ppxp, yet another PPP program, does not release root privileges when opening potentially user supplied log files. This can be tricked into opening a root shell...

CVE-2004-1452

Tomcat before 5.0.27-r3 in Gentoo Linux sets the default permissions on the init scripts as tomcat:tomcat, but executes the scripts with root privileges, which could allow local users in the tomcat group to execute arbitrary commands as root by modifying the scripts...

Important: Red Hat Security Advisory: perl security update

Updated Perl packages that fix several security issues are now available for Red Hat Enterprise Linux 3. Perl is a high-level programming language commonly used for system administration utilities and Web programming. Kevin Finisterre discovered a stack based buffer overflow flaw in sperl, the Pe...

CVE-2004-0793

The calendar program in bsdmainutils 6.0 through 6.0.14 does not drop root privileges when executed with the -a flag, which allows attackers to execute arbitrary commands via a calendar event file...

CDRecord's ReadCD Local Root Privileges

Exploit for linux platform in category local exploits ======================================= CDRecord's ReadCD Local Root Privileges ======================================= !/bin/bash echo "readcd-exp.sh -- ReadCD local exploit Test on cdrecord-2.01-0.a27.2mdk" echo "Author : newbug at chroot.or...

Mandrake Linux Security Advisory : kernel (MDKSA-2001:079-2)

Alexander Viro discovered a vulnerability in the devfs implementation that is shipped with Mandrake Linux 8.1. We are aware of the problem and are currently working on a solution. As a workaround, until an update becomes available, please boot with the devfs=nomount option. Rafal Wojtczuk found a...

SUS 2.0.2 local root vulnerability

LSS Security Advisories http://security.lss.hr --- Title : SUS 2.0.2 local root vulnerability Advisory ID : LSS2004-09-01 Date : September 14th, 2004 Advisory URL: : http://security.lss.hr/index.php?page=details&ID=LSS-2004-09-01 Impact : Any user can obtain root privileges Risk level : High...

cdrtools: Local root vulnerability in cdrecord if set SUID root

Background The cdrtools package is a set of tools for CD recording, including the popular cdrecord command-line utility. Description Max Vozeler discovered that the cdrecord utility, when set to SUID root, fails to drop root privileges before executing a user-supplied RSH program. By default,...

[Full-Disclosure] MDKSA-2004:091 - Updated cdrecord packages fix local root vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandrakelinux Security Update Advisory Package name: cdrecord Advisory ID: MDKSA-2004:091 Date: September 7th, 2004 Affected versions: 10.0, 9.2 Problem Description: Max Vozeler found that the cdrecord program, which is suid root, fails to drop euid=0...

Debian proftpd root Privilege Escalation

Binary data 1817.prm...

Mandrake Linux Security Advisory : openssh (MDKSA-2002:019)

Joost Pol found a bug in the channel code of all versions of OpenSSH from 2.0 to 3.0.2. This bug can allow authenticated users with an existing account on the vulnerable system to obtain root privilege or by a malicious server attacking a vulnerable client. OpenSSH 3.1 is not vulnerable to this...