Slackware 7.1 - usrbinmail Local Privilege Escalation

Slackware 7.1 - usrbinmail Local Privilege Escalation / Slackware 7.1 /usr/bin/Mail Exploit give gid=1 bin if /usr/bin/Mail is setgid but it is not setgid, setuid for default. tested on my box sl 7.1 crazy exploited by kengz. GID.... \x01 = 1 bin \x02 = 2 , \x03 = 3 , ... \x0a = 10 \x0b = 11 .......

CVE-2001-0084

The CVE-2001-0084 issue affects the GTK+ library, where the GTK_MODULES environment variable lets local users specify arbitrary modules. If GTK+ is used by a setuid/setgid program, this can let local users gain privileges. Reports from PT-2001-1319 describe GTK+ (affected versions not specified) ...

CVE-2001-0084

GTK+ library allows local users to specify arbitrary modules via the GTKMODULES environmental variable, which could allow local users to gain privileges if GTK+ is used by a setuid/setgid program...

Fixed local AIX V43 vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Just for the record, here are some local AIX vulnerabilities we have found, and which have been fixed by IBM this year. If you have been applying fixes, there should be no problem with these anymore. But it might be interesting to know what some of those massive...

BSDi 3.0/4.0 rcvtty gid=tty exploit... (mh package)

well, i dont know if rcvtty is suppost to be setgid in general, since ive never seen it setgid on anything but BSDi 3.0 and 4.0. but none-the-less, here is a exploit i wrote for it: original ver: http://realhalo.org/xrcvtty.c xrcvtty.cmodified from original: ---------------------------------- /...

BSDi 3.0 / 4.0 rcvtty[mh] Local Exploit

Exploit for bsd platform in category local exploits ======================================= BSDi 3.0 / 4.0 rcvttymh Local Exploit ======================================= / BSDi3.0/4.0rcvttymh local exploit, by v9email protected. this exploit is for the rcvtty of the mh package, which is setgid=4t...

BSDi 3.04.0 - rcvtty[mh] Local Privilege Escalation

BSDi 3.04.0 - rcvttymh Local Privilege Escalation / BSDi3.0/4.0rcvttymh local exploit, by [email protected]. this exploit is for the rcvtty of the mh package, which is setgid=4tty on BSDi. this exploit gives you egid/group=4tty access. example: -------------------------------------------------...

BSDi 3.0/4.0 - 'rcvtty[mh]' Local Privilege Escalation

/ BSDi3.0/4.0rcvttymh local exploit, by [email protected]. this exploit is for the rcvtty of the mh package, which is setgid=4tty on BSDi. this exploit gives you egid/group=4tty access. example: ------------------------------------------------- bash-2.02$ id uid=101v9 gid=100user groups=100user...

CVE-2000-0604

CVE-2000-0604 involves the gkermit component on Red Hat Linux installed with the setgid uucp bit, enabling local users to modify files owned by uucp. The underlying issue is an improper installation/permission setup of gkermit, which allows a local attacker to gain partial access to files owned b...

ncurses-overflow.txt

OVERVIEW The CRT screen handling library ncurses contains buffer overflows, making programs using it vulnerable. If the programs are setuid or setgid, a local user may elevate their privilege. The problem exists in ncurses versions 4.2 and 5.0, probably earlier, and libocurses. The overflows can ...

[SECURITY] new version of screen released

Package: screen Vulnerability: local exploit Debian-specific: no A format string bug was recently discovered in screen which can be used to gain elevated privilages if screen is setuid. Debian 2.1 slink did ship screen setuid and the exploit can be used to gain root privilages. In Debian 2.2 pota...

AIX 4.24.3 - usrliblpdpioetcpiomkapqd Local Buffer Overflow

AIX 4.24.3 - usrliblpdpioetcpiomkapqd Local Buffer Overflow // source: https://www.securityfocus.com/bid/3238/info // // The 'piomkapqd' utility is a component of the AIX printing subsystem. By default, it is installed setgid and owned by the 'printk' group. // // 'piomkapqd' contains a locally...

2dopewars_exploits.txt

two security holes i found for local use in dopewars1.4.7-current. dopewars is setgid=games. by: [email protected]. LOCAL VULNERABILITY 1: insecure popen call, a shell script can handle this. -- dopewars.sh start -- !/bin/sh dopewars.sh1.4.7: shell script by [email protected]. gives...

rh 6.2 - gid compromises, etc

Probably it's nothing exciting, but several packets supplied with RH 6.2 will allow 500 gid/uid compromises. On every system it HAS some kind of meaning - sometimes just a little exceeding quotas, hiding from accounting, anonymous intrusions to other systems - but sometimes compromised uucp or ne...

CVE-2000-0604

gkermit in Red Hat Linux is improperly installed with setgid uucp, which allows local users to modify files owned by uucp...

Mandriva Linux Mandrake 7.0 - Local Buffer Overflow

Mandriva Linux Mandrake 7.0 - Local Buffer Overflow // source: https://www.securityfocus.com/bid/1265/info The linux cdrecorder binary is vulnerable to a locally exploitable buffer overflow attack. When installed in a Mandrake 7.0 linux distribution, it is by default setgid "cdburner" which is a...

KDE 1.11.1.11.22.0 kscd - SHELL Environmental Variable

KDE 1.11.1.11.22.0 kscd - SHELL Environmental Variable source: https://www.securityfocus.com/bid/1206/info Some linux distributions S.u.S.E. 6.4 reported ship with kscd a CD player for the KDE Desktop sgid disk. kscd uses the contents of the 'SHELL' environment variable to execute a browser. This...

Дырка в gpm

при запуске пользовательского приложения из gmp-root сначала выполняется setuid и только потом setgid, который не срабатывает. В результате, пользовательское приложение запускается с gid wheel...

gpm 1.18.1/1.19 / Debian 2.x / RedHat 6.x / S.u.S.E 5.3/6.x - gpm Setgid

source: https://www.securityfocus.com/bid/1069/info A vulnerability exists in the gpm-root program, part of the gpm package. This package is used to enable mice on the consoles of many popular Linux distributions. The problem is a design error, caused when a programmer chose to attempt to revert ...

gpm 1.18.11.19 Debian 2.x RedHat 6.x S.u.S.E 5.36.x - gpm Setgid

gpm 1.18.11.19 Debian 2.x RedHat 6.x S.u.S.E 5.36.x - gpm Setgid source: https://www.securityfocus.com/bid/1069/info A vulnerability exists in the gpm-root program, part of the gpm package. This package is used to enable mice on the consoles of many popular Linux distributions. The problem is a...