MS07-053: Vulnerability in Windows Services for UNIX Could Allow Elevation of Privilege (939778)

The remote host is running a version of the Windows Services for UNIX that is vulnerable to a local privileges elevation due to a flaw in different setuid binary files. An attacker may use this to elevate his privileges on this host. Tenable Network Security, Inc. include"compat.inc"; if...

USN-508-1: Linux kernel vulnerabilities

A buffer overflow was discovered in the Moxa serial driver. Local attackers could execute arbitrary code and gain root privileges. CVE-2005-0504 A flaw was discovered in the IPv6 stack's handling of type 0 route headers. By sending a specially crafted IPv6 packet, a remote attacker could cause a...

USN-509-1: Linux kernel vulnerabilities

A flaw in the sysfsreaddir function allowed a local user to cause a denial of service by dereferencing a NULL pointer. CVE-2007-3104 A buffer overflow was discovered in the random number generator. In environments with granular assignment of root privileges, a local attacker could gain additional...

CVE-2007-3848

Linux kernel 2.4.35 and other versions allows local users to send arbitrary signals to a child process that is running at higher privileges by causing a setuid-root parent process to die, which delivers an attacker-controlled parent process death signal PRSETPDEATHSIG...

CVE-2007-3848

Linux kernel 2.4.35 and other versions allows local users to send arbitrary signals to a child process that is running at higher privileges by causing a setuid-root parent process to die, which delivers an attacker-controlled parent process death signal PRSETPDEATHSIG...

CVE-2007-3848

Linux kernel 2.4.35 and other versions allows local users to send arbitrary signals to a child process that is running at higher privileges by causing a setuid-root parent process to die, which delivers an attacker-controlled parent process death signal PRSETPDEATHSIG...

IBM AIX FTP客户端本地溢出漏洞

BUGTRAQ ID: 25077 CVECAN ID: CVE-2007-4004 IBM AIX是一款商业性质的UNIX操作系统。 AIX FTP客户端程序实现上存在缓冲区溢出漏洞，本地攻击者可能利用此漏洞提升自己的权限。 AIX操作系统中所捆绑的FTP程序没有正确地处理对gets函数的调用。gets函数用于将标准输入的数据读取到缓冲区，但没有指定所读入缓冲区的最大大小，因此可能导致多个溢出漏洞。FTP程序是以root用户权限运行的，任何本地用户都可以执行。至少有一个漏洞会导致可利用的栈溢出。 IBM AIX 5.3 IBM AIX 5.2 临时解决方法：...

IBM AIX Pioout任意库加载命令执行漏洞

BUGTRAQ ID: 25084 CVECAN ID: CVE-2007-4003 IBM AIX是一款商业性质的UNIX操作系统。 AIX操作系统所随捆绑的pioout程序处理命令行参数时存在漏洞，本地攻击者可能利用此漏洞提升自己的权限。 pioout程序没有丢弃权限便加载了攻击者所提供的任意共享库，如果使用了-R命令行参数攻击者就可以指定用于解析打印机数据的共享库。pioout程序拥有root setuid，任何本地用户都可以执行，因此本地攻击者可以通过创建一个执行shell的共享库导致以root用户权限执行任意命令。 IBM AIX 5.3 IBM AIX 5.2 临时解决方法：...

Buffer overflow

Buffer overflow in cli32 in Areca CLI 1.72.250 and earlier might allow local users to gain privileges via a long argument. NOTE: this program is not setuid by default, but there are some usage scenarios in which an administrator might make it setuid...

CVE-2007-4027

Buffer overflow in cli32 in Areca CLI 1.72.250 and earlier might allow local users to gain privileges via a long argument. NOTE: this program is not setuid by default, but there are some usage scenarios in which an administrator might make it setuid...

IBM AIX 5.2/5.3 - Capture Command Local Stack Buffer Overflow

// source: https://www.securityfocus.com/bid/25075/info IBM AIX is prone to a local, stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input to a program that is installed setuid-superuser. Local attackers can exploit this issue to...

Design/Logic Flaw

The wrapsetuidthirdpartyapplication function in the installation script for the Samsung SCX-4200 Driver 2.00.95 adds setuid permissions to third party applications such as xsane and xscanimage, which allows local users to gain privileges...

CVE-2007-3931

CVE-2007-3931 affects the Samsung SCX-4200 Driver 2.00.95 installation script. The wrap_setuid_third_party_application function grants setuid permissions to third-party applications (e.g., xsane, xscanimage), enabling local users to escalate privileges. Documented impact is privilege escalation f...

CVE-2007-3931

The wrapsetuidthirdpartyapplication function in the installation script for the Samsung SCX-4200 Driver 2.00.95 adds setuid permissions to third party applications such as xsane and xscanimage, which allows local users to gain privileges...

bsd/x86 setuid/execve shellcode 30 bytes

Exploit for bsd/x86 platform in category shellcode ======================================== bsd/x86 setuid/execve shellcode 30 bytes ======================================== / $Id: setuid-bsd.c,v 1.6 2004/06/02 12:22:30 raptor Exp $ setuid-bsd.c - setuid/execve shellcode for BSD/x86 Copyright c...

bsd/x86 setuid/portbind shellcode 94 bytes

Exploit for bsd/x86 platform in category shellcode ========================================== bsd/x86 setuid/portbind shellcode 94 bytes ========================================== / $Id: portbind-bsd.c,v 1.3 2004/06/02 12:22:30 raptor Exp $ portbind-bsd.c - setuid/portbind shellcode for BSD/x86...

security flaw

Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long...

Ingres wakeup setuid(ingres) file truncation

======= Summary ======= Name: wakeup setuidingres file truncation Release Date: 25 June 2007 Reference: NGS00390 Discover: Chris Anley [email protected] Vendor: Ingres Vendor Reference: Ingres bug 115913, CVE-2007-3337, CAID 35451 Systems Affected: Ingres 2006 9.0.4 and prior Risk: Medium...

Sun Solaris srsexec任意文件读取本地信息泄露漏洞

Solaris是一款由Sun开发和维护的商业性质UNIX操作系统。 Solaris系统的srsexec工具在处理文件访问权限时存在漏洞，本地攻击者可能利用此漏洞读取部分敏感文件内容。 如果安装了SUNWsrspx软件包的话，则该软件包中的srsexec工具可能允许本地攻击者访问敏感信息，如root口令哈希。漏洞起因是没有丢弃或检查目标文件的权限，如果用户指定了verify only模式（-v）及debug（-d）模式的话，且指定了受保护的文件（如/etc/shadow），srsexec就会在debug消息中显示/etc/shadow的第一行。 Sun SRS Net Connect...

GLSA-200704-22 : BEAST: Denial of Service

The remote host is affected by the vulnerability described in GLSA-200704-22 BEAST: Denial of Service BEAST, which is installed as setuid root, fails to properly check whether it can drop privileges accordingly if seteuid fails due to a user exceeding assigned resource limits. Impact : A local us...