ld.so bug - LD_DEBUG_OUTPUT follows symlinks

Hi, ld.so from glibc2 doesn't unset variables LDDEBUGOUTPUT and LDDEBUG when running suid. If program calls setuid0 and then fork, child process will follow prepared symlink $LDDEBUGOUTPUT.$pid and overwrites any file in system. Jakub Vlasek...

Ports Security Advisory: FreeBSD-SA-00:49.eject

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:49 Security Advisory FreeBSD, Inc. Topic: eject port allows local root exploit Category: ports Module: eject Announced: 2000-09-13 Affects: Ports collection. Corrected:...

LPPlus 3.2.23.3 - Permissions Denial of Service

LPPlus 3.2.23.3 - Permissions Denial of Service source: https://www.securityfocus.com/bid/1643/info Vulnerability 1: Several files that are part of the LPPlus print management system are installed setuid root by default. These files include: $LPHOME/bin/dccsched $LPHOME/bin/dcclpdser...

LPPlus 3.2.2/3.3 - Permissions Denial of Service

source: https://www.securityfocus.com/bid/1643/info Vulnerability 1: Several files that are part of the LPPlus print management system are installed setuid root by default. These files include: $LPHOME/bin/dccsched $LPHOME/bin/dcclpdser $LPHOME/bin/dccbkst These start the scheduler, LPD server an...

[SECURITY] glibc update for Debian GNU/Linux 2.1 (update)

Package: glibc Vulnerability: local exploit Debian-specific: no Recently two problems have been found in the glibc suite, which could be used to trick setuid applications to run arbitrary code. An earlier advisory listed the updates for Debian 2.2/potato. This advisory contains updates for Debian...

Serious vulnerability in glibc

PROBLEM DESCRIPTION A vulnerability exists in glibc versions up to version 2.1.3, ie. all released versions, allowing local users to get root access. Fix packages for most major Linux distributions have been released or will be released within a day or two. There's also a quick workaround describ...

Juergen Weigert screen 3.9 - User Supplied Format String

Juergen Weigert screen 3.9 - User Supplied Format String // source: https://www.securityfocus.com/bid/1641/info Various format string vulnerabilities exist in versions 3.9.5 and prior of 'screen' that may allow local users to elevate their privileges. If screen is setuid root, it is possible to...

Juergen Weigert screen 3.9 - User Supplied Format String

// source: https://www.securityfocus.com/bid/1641/info Various format string vulnerabilities exist in versions 3.9.5 and prior of 'screen' that may allow local users to elevate their privileges. If screen is setuid root, it is possible to alter the contents of the variable which stores the user i...

screen 3.9.5 root vulnerability

PROBLEM DESCRIPTION A vulnerability exists in the program "screen" version 3.9.5 and earlier. If screen is installed setuid root, a local user may gain root privilege. There are many systems where the program isn't setuid root by default, but on many systems afaik at least SuSE Linux, Red Hat 5.2...

[SECURITY] glibc update for Debian GNU/Linux 2.1

Package: glibc Vulnerability: local exploit Debian-specific: no Recently two problems have been found in the glibc suite, which could be used to trick setuid applications to run arbitrary code. An earlier advisory listed the updates for Debian 2.2/potato. This advisory contains updates for Debian...

[SECURITY] new version of screen released

Package: screen Vulnerability: local exploit Debian-specific: no A format string bug was recently discovered in screen which can be used to gain elevated privilages if screen is setuid. Debian 2.1 slink did ship screen setuid and the exploit can be used to gain root privilages. In Debian 2.2 pota...

[SECURITY] New version of glibc released

Package: glibc Vulnerability: local exploit Debian-specific: no Recently two problems have been found in the glibc suite, which could be used to trick setuid applications to run arbitrary code. The first problem is the way ld.so handles environment variables: in order to provide a safe environmen...

[SECURITY] New version of glibc released

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman September 2, 2000 - ------------------------------------------------------------------------ Package: glibc Vulnerability: local...

cmctl_exp

! /usr/bin/ksh cmctl is installed setuid to Oracle by default. See BugTraq ID 170 and Oracle bug id 701297 and 714293. This script will create a setuid Oracle shell, /tmp/.sh redirect environment variables export ORACLEHOME=/tmp export ORAHOME=/tmp mkdir /tmp/bin chmod a+rx /tmp/bin create cmadmi...

David Bagley xlock 4.16 - User Supplied Format String (1)

// source: https://www.securityfocus.com/bid/1585/info A vulnerability exists in versions of the xlockmore program, originally written by David Bagley. It is believed to affect all versions of xlock derived from xlockmore. This includes the xlock shipped with a number of popular operating systems...

David Bagley xlock 4.16 - User Supplied Format String (1)

David Bagley xlock 4.16 - User Supplied Format String 1 // source: https://www.securityfocus.com/bid/1585/info A vulnerability exists in versions of the xlockmore program, originally written by David Bagley. It is believed to affect all versions of xlock derived from xlockmore. This includes the...

Luca Deri ntop 1.2 a7-91.3.1 - Remote Buffer Overflow

Luca Deri ntop 1.2 a7-91.3.1 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/1576/info ntop is a network usage monitoring tool for unix systems. It can be invoked at the console or as a server daemon, presenting statistics information via http with the -w parameter. In this...

Possible vulnerability in HPUX

Hello, Few days ago i read the mail Hackerslab bugpaper HP-UX bdf -t option buffer overflow vul. And decided to see any other possible vulnerabilityies on my ststem. HP-UX 10.20. After a few minutes maybe a little more : ,trying each setuid exe with different options, i finally got results as for...

linux/x86 break chroot setuid(0) + /bin/sh 132 bytes

Exploit for linux/x86 platform in category shellcode ==================================================== linux/x86 break chroot setuid0 + /bin/sh 132 bytes ==================================================== / Linux/x86 - setreuid0, 0; - chroot-break make a temp dir with mkdir, chroot to tempdi...

linux/x86 break chroot setuid0 + /bin/sh 132 bytes

linux/x86 break chroot setuid0 + /bin/sh 132 bytes. Shellcode exploit for linx86 platform / Linux/x86 - setreuid0, 0; - chroot-break make a temp dir with mkdir, chroot to tempdir, go through a loop of chdir".."; then a final chroot"."; - execve of /bin/sh used in several wu-ftpd, beroftpd and...