Pine Internet Advisory: Setuid application execution may give local root in FreeBSD

-----BEGIN PGP SIGNED MESSAGE----- ----------------------------------------------------------------------------- Pine Internet Security Advisory ----------------------------------------------------------------------------- Advisory ID : PINE-CERT-20020401 Authors : Joost Pol [email protected] Issue...

Security Update: [CSSA-2002-SCO.15] Open UNIX 8.0.0 UnixWare 7.1.1 : Buffer overflow in libX11 with -xrm

To: [email protected] [email protected] [email protected] Caldera International, Inc. Security Advisory Subject: Open UNIX 8.0.0 UnixWare 7.1.1 : Buffer overflow in libX11 with -xrm Advisory number: CSSA-2002-SCO.15 Issue date: 2002 April 11 Cross reference: 1. Problem...

AZL-36938 CVE-2002-0130 affecting package efax 0.9a-34

Buffer overflow in efax 0.9 and earlier, when installed setuid root, allows local users to execute arbitrary code via a long -x argument...

AZL-36937 CVE-2002-0129 affecting package efax 0.9a-34

efax 0.9 and earlier, when installed setuid root, allows local users to read arbitrary files via the -d option, which prints the contents of the file in a warning message...

CVE-2002-0129

efax 0.9 and earlier, when installed setuid root, allows local users to read arbitrary files via the -d option, which prints the contents of the file in a warning message...

AZL-7197 CVE-2002-0129 affecting package efax 0.9a-34

efax 0.9 and earlier, when installed setuid root, allows local users to read arbitrary files via the -d option, which prints the contents of the file in a warning message...

AZL-7198 CVE-2002-0130 affecting package efax 0.9a-34

Buffer overflow in efax 0.9 and earlier, when installed setuid root, allows local users to execute arbitrary code via a long -x argument...

Compaq tru64 setuids /usr/bin/at and /usr/dt/bin/mailcv

Heres some the results of my latenight audit on Tru64. Its too late for me to mess with Compaqs web site to get the security contact I am tired and don't care or something. If someone has TRU64 gdb binaries I would love them... its too late for me to be playing with the Tru64 ladebug also... get ...

CVE-2002-0129

The CVE-2002-0129 issue affects efax 0.9 and earlier when installed setuid root. The vulnerability allows local users to read arbitrary files by using the -d option, which prints the file contents in a warning message. The underlying flaw is a local privilege issue that exposes sensitive data (co...

CVE-2002-0130

CVE-2002-0130 is a buffer overflow in efax 0.9 and earlier when installed setuid root, allowing local users to execute arbitrary code via a long -x argument. Affected package reference appears as efax 0.9a-34 in at least one listing. The vulnerability is exploitable locally; the documents do not ...

CVE-1999-1142

SunOS 4.1.2 and earlier allows local users to gain privileges via LD_* environment variables affecting dynamically linked setuid/setgid programs (e.g., login, su, sendmail) by causing real and effective UIDs to the same user. This yields a local escalation with complete confidentiality and integr...

CVE-1999-1382

CVE-1999-1382 describes a local privilege escalation in NetWare NFS mode 1 and 2. The issue arises when NetWare-NFS implements the Unix Read Only flag by changing a file’s ownership to root, which can be exploited by a local user who creates a setuid program and marks it as Read Only; NetWare-NFS...

CVE-1999-1382

NetWare NFS mode 1 and 2 implements the "Read Only" flag in Unix by changing the ownership of a file to root, which allows local users to gain root privileges by creating a setuid program and setting it to "Read Only," which NetWare-NFS changes to a setuid root program...

CVE-1999-1143

Vulnerability in runtime linker program rld in SGI IRIX 6.x and earlier allows local users to gain privileges via setuid and setgid programs...

CVE-1999-1143

Technical details for CVE-1999-1143 are not provided in the connected documents. The initial description summarizes a privilege escalation in SGI IRIX 6.x rld but no further public details are included here. Monitor for updates.

CVE-2000-0615

LPRng 3.6.x improperly installs lpd as setuid root, which can allow local users to append lpd trace and logging messages to files...

CVE-2000-0615

CVE-2000-0615 : LPRng 3.6.x improperly installs lpd as setuid root, allowing local users to append lpd trace and logging messages to files. The connected documents confirm the vulnerability is a local privilege issue tied to the lpd binary running with root privileges. No explicit exploit details...

CVE-1999-1205

nettune in HP-UX 10.01 and 10.00 is installed setuid root, which allows local users to cause a denial of service by modifying critical networking configuration information...

Unixware Message catalog exploit code

Hi, I'm jGgM. I was reported this problem Caldera, a few week ago. And, This exploit is fixed already. Hacker can modify message catalog and, It can possible format string exploit. for example $ gcc -o expshell expshell.c $ gcc -o getret getret.c $ gcc -o fmtexp fmtexp.c $ ./expshell $ ./getret...

NetBSD Security Advisory 2002-001 Close-on-exec, SUID and ptrace(2)

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2002-001 ================================= Topic: Close-on-exec, SUID and ptrace2 Version: NetBSD-current: prior to January 14, 2002 NetBSD-1.5.: affected up to and including 1.5.2 NetBSD-1.4.: affected up to and including 1.4.3 Severity...