DEBIAN-CVE-2005-1270

The 1 checkupdate.sh and 2 rkhunter script in Rootkit Hunter before 1.2.3-r1 create temporary files with predictable file names, which allows local users to overwrite arbitrary files via a symlink attack...

Rootkit Hunter: Insecure temporary file creation

Background Rootkit Hunter is a scanning tool to detect rootkits, backdoors and local exploits on a local machine. Rootkit Hunter uses downloaded data files to check file integrity. These files are updated via the checkupdate.sh script. Description Sune Kloppenborg Jeppesen and Tavis Ormandy of th...

RKDetect - behaviour based rootkit detection utility

Rkdetect is a little anomaly detection tool which can find services hidden by generic Windows rootkits like Hacker Defender. Tool very simply. It enumerates services on remote computer through WMI user level and Services Control Manager kernel level, compare result and display difference. In this...

Loading Rootkit using SystemLoadAndCallImage

Greets, For a while there has been a thread on NTBUGTRAQ about kernel-mode protection from rootkits. This is good - the whole point of our rootkit.com project is to get people thinking about the problem. For example, there is now an ANTI-Rootkit called Integrity Protection Driver from Pedestal...