RedHat Linux dump 缓冲区溢出漏洞

RedHat Linux中有一个文件备份工具"dump".它被安装在 /sbin下并且被设置了setuid/setgid root位。当传送一个很长的字符串给"-f a"参数时，dump将发生堆栈溢出。如果提供的参数经过精心构造，攻击者就可能替代堆栈中保存的EIP指令指针或者返回地址并以gid root权限来执行任意代码。Dump在crash时会丢弃setuid root权限，但是没有丢弃setgid root权限。因此攻击者可能利用这个漏洞获得setgid root权限，进而可能获取对整个系统的控制权。 MandrakeSoft Linux Mandrake 7.0...

Linux Kernel < 2.4.20 Module Loader Local Root Exploit

No description provided by source. / Linux Kernel Module Loader Local R00t Exploit Up to 2.4.20 By anonymous KuRaK include stdio.h include stdlib.h include signal.h include fcntl.h include errno.h include unistd.h include sys/types.h include sys/stat.h include sys/ptrace.h include sys/wait.h...

Solaris 7/8/9 CDE LibDTHelp Local Buffer Overflow Exploit

No description provided by source. / $Id: raptorlibdthelp.c,v 1.1 2004/12/04 14:44:38 raptor Exp $ raptorlibdthelp.c - libDtHelp.so local, Solaris/SPARC 7/8/9 Copyright c 2003-2004 Marco Ivaldi [email protected] Buffer overflow in CDE libDtHelp library allows local users to execute arbitrary...

GKrellM GKrellWeather 0.2.7 Plugin - Local Stack Buffer Overflow

// source: https://www.securityfocus.com/bid/27744/info The GKrellWeather plugin for GKrellM is prone to a local stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer. An attacker can exploit this...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation. The padroproot function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from 1 setresuid, 2 setreuid, 3 setuid, and 4 seteuid calls when attempting to drop privileges, which might...

DEBIAN-CVE-2008-0008

The padroproot function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from 1 setresuid, 2 setreuid, 3 setuid, and 4 seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as...

CVE-2008-0008

The CVE-2008-0008 issue affects PulseAudio 0.9.8 and certain 0.9.9 builds where pa_drop_root does not check return values from setresuid, setreuid, setuid, and seteuid when dropping privileges. This could allow a local user to escalate privileges if those calls fail (e.g., due to resource exhaust...

CVE-2008-0008

The padroproot function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from 1 setresuid, 2 setreuid, 3 setuid, and 4 seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as...

pulseuadio privilege escalation

setuid result is not checked...

Debian Security Advisory DSA 895-1 (uim)

The remote host is missing an update to uim announced via advisory DSA 895-1. Masanari Yamamoto discovered incorrect use of environment variables in uim, a flexible input method collection and library, that could lead to escalated privileges in setuid/setgid applications linked to libuim. Affecte...

Debian Security Advisory DSA 563-1 (cyrus-sasl)

The remote host is missing an update to cyrus-sasl announced via advisory DSA 563-1. OpenVAS Vulnerability Test $Id: deb5631.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 563-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 385-1 (hztty)

The remote host is missing an update to hztty announced via advisory DSA 385-1. OpenVAS Vulnerability Test $Id: deb3851.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 385-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian: Security Advisory (DSA-310)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 463-1 (samba)

The remote host is missing an update to samba announced via advisory DSA 463-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-696-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-557-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 364-1 (man-db)

The remote host is missing an update to man-db announced via advisory DSA 364-1. OpenVAS Vulnerability Test $Id: deb3641.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 364-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian: Security Advisory (DSA-1150-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 1150-1 (shadow)

The remote host is missing an update to shadow announced via advisory DSA 1150-1. A bug has been discovered in several packages that execute the setuid system call without checking for success when trying to drop privileges, which may fail with some PAM configurations. OpenVAS Vulnerability Test...

Debian Security Advisory DSA 1271-1 (openafs)

The remote host is missing an update to openafs announced via advisory DSA 1271-1. A design error has been identified in the OpenAFS, a cross-platform distributed filesystem included with Debian. OpenAFS historically has enabled setuid filesystem support for the local cell. However, with its...