Solaris 8 libsldap - Local Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/2931/info Solaris 8 ships with a shared library that implements LDAP functionality called 'libsldap'. This library is linked to by a number of system utilities, many of them installed setuid or setgid. Libsldap contains a buffer overflow vulnerability ...

CVE-2001-0170

Technical specifics (affected product versions, root cause, mitigations, or exploit details) are not publicly provided in the supplied documents; monitor for updates.

minicom exploit

This advisory was posted Wed Apr 11 08:06:49 2001 to bugzilla.redhat.com/bugzilla and became inaccessable not long after. I went to add more information, a couple of days after and had been locked out, so I tried emailing the QAContact this information on Tue Apr 24 , but received no reply. Now...

Linux Kernel 2.2.18 (RedHat 6.2/7.0 / 2.2.14/2.2.18/2.2.18ow4) - ptrace/execve Race Condition Privilege Escalation (1)

/ EDB Note: Updated exploit can be found here: https://www.exploit-db.com/exploits/20721/ source: https://www.securityfocus.com/bid/2529/info The Linux kernel is the core of all distributions of the Linux Operating System. It was originally written by Linus Torvalds, and is maintained by a...

[SECURITY] [DSA-044-1] mailx local exploit

Package : mailx Problem type : buffer overflow Debian-specific: no The mail program a simple tool to read and send email as distributed with Debian GNU/Linux 2.2 has a buffer overflow in the input parsing code. Since mail is installed setgid mail by default this allowed local users to use it to...

Slackware 7.1 - '/usr/bin/mail' Local Privilege Escalation

/ Slackware 7.1 /usr/bin/Mail Exploit give gid=1 bin if /usr/bin/Mail is setgid but it is not setgid, setuid for default. tested on my box sl 7.1 crazy exploited by kengz. GID.... \x01 = 1 bin \x02 = 2 , \x03 = 3 , ... \x0a = 10 \x0b = 11 .... / include include define GID "\x03" int mainint argc,...

Slackware 7.1 - usrbinmail Local Privilege Escalation

Slackware 7.1 - usrbinmail Local Privilege Escalation / Slackware 7.1 /usr/bin/Mail Exploit give gid=1 bin if /usr/bin/Mail is setgid but it is not setgid, setuid for default. tested on my box sl 7.1 crazy exploited by kengz. GID.... \x01 = 1 bin \x02 = 2 , \x03 = 3 , ... \x0a = 10 \x0b = 11 .......

CVE-2001-0084

The CVE-2001-0084 issue affects the GTK+ library, where the GTK_MODULES environment variable lets local users specify arbitrary modules. If GTK+ is used by a setuid/setgid program, this can let local users gain privileges. Reports from PT-2001-1319 describe GTK+ (affected versions not specified) ...

CVE-2001-0084

GTK+ library allows local users to specify arbitrary modules via the GTKMODULES environmental variable, which could allow local users to gain privileges if GTK+ is used by a setuid/setgid program...

Fixed local AIX V43 vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Just for the record, here are some local AIX vulnerabilities we have found, and which have been fixed by IBM this year. If you have been applying fixes, there should be no problem with these anymore. But it might be interesting to know what some of those massive...

BSDi 3.0/4.0 rcvtty gid=tty exploit... (mh package)

well, i dont know if rcvtty is suppost to be setgid in general, since ive never seen it setgid on anything but BSDi 3.0 and 4.0. but none-the-less, here is a exploit i wrote for it: original ver: http://realhalo.org/xrcvtty.c xrcvtty.cmodified from original: ---------------------------------- /...

BSDi 3.04.0 - rcvtty[mh] Local Privilege Escalation

BSDi 3.04.0 - rcvttymh Local Privilege Escalation / BSDi3.0/4.0rcvttymh local exploit, by [email protected]. this exploit is for the rcvtty of the mh package, which is setgid=4tty on BSDi. this exploit gives you egid/group=4tty access. example: -------------------------------------------------...

BSDi 3.0 / 4.0 rcvtty[mh] Local Exploit

Exploit for bsd platform in category local exploits ======================================= BSDi 3.0 / 4.0 rcvttymh Local Exploit ======================================= / BSDi3.0/4.0rcvttymh local exploit, by v9email protected. this exploit is for the rcvtty of the mh package, which is setgid=4t...

BSDi 3.0/4.0 - 'rcvtty[mh]' Local Privilege Escalation

/ BSDi3.0/4.0rcvttymh local exploit, by [email protected]. this exploit is for the rcvtty of the mh package, which is setgid=4tty on BSDi. this exploit gives you egid/group=4tty access. example: ------------------------------------------------- bash-2.02$ id uid=101v9 gid=100user groups=100user...

CVE-2000-0604

CVE-2000-0604 involves the gkermit component on Red Hat Linux installed with the setgid uucp bit, enabling local users to modify files owned by uucp. The underlying issue is an improper installation/permission setup of gkermit, which allows a local attacker to gain partial access to files owned b...

ncurses-overflow.txt

OVERVIEW The CRT screen handling library ncurses contains buffer overflows, making programs using it vulnerable. If the programs are setuid or setgid, a local user may elevate their privilege. The problem exists in ncurses versions 4.2 and 5.0, probably earlier, and libocurses. The overflows can ...

[SECURITY] new version of screen released

Package: screen Vulnerability: local exploit Debian-specific: no A format string bug was recently discovered in screen which can be used to gain elevated privilages if screen is setuid. Debian 2.1 slink did ship screen setuid and the exploit can be used to gain root privilages. In Debian 2.2 pota...

AIX 4.24.3 - usrliblpdpioetcpiomkapqd Local Buffer Overflow

AIX 4.24.3 - usrliblpdpioetcpiomkapqd Local Buffer Overflow // source: https://www.securityfocus.com/bid/3238/info // // The 'piomkapqd' utility is a component of the AIX printing subsystem. By default, it is installed setgid and owned by the 'printk' group. // // 'piomkapqd' contains a locally...

2dopewars_exploits.txt

two security holes i found for local use in dopewars1.4.7-current. dopewars is setgid=games. by: [email protected]. LOCAL VULNERABILITY 1: insecure popen call, a shell script can handle this. -- dopewars.sh start -- !/bin/sh dopewars.sh1.4.7: shell script by [email protected]. gives...

rh 6.2 - gid compromises, etc

Probably it's nothing exciting, but several packets supplied with RH 6.2 will allow 500 gid/uid compromises. On every system it HAS some kind of meaning - sometimes just a little exceeding quotas, hiding from accounting, anonymous intrusions to other systems - but sometimes compromised uucp or ne...