MIT Kerberos 5: Multiple local privilege escalation vulnerabilities

Background MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. Description Unchecked calls to setuid in krshd and v4rcp, as well as unchecked calls ...

CVE-2006-3083

The 1 krshd and 2 v4rcp applications in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges usi...

DEBIAN-CVE-2006-3083

The 1 krshd and 2 v4rcp applications in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges usi...

CVE-2006-3083

The 1 krshd and 2 v4rcp applications in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges usi...

CVE-2006-3083

The 1 krshd and 2 v4rcp applications in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges usi...

DEBIAN-CVE-2006-3084

The 1 ftpd and 2 ksu programs in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not kno...

CVE-2006-3084

The 1 ftpd and 2 ksu programs in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not kno...

CVE-2006-3084

The 1 ftpd and 2 ksu programs in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not kno...

CVE-2006-3084

CVE-2006-3084 affects MIT Kerberos 5 (krb5) up to 1.5 and 1.4.x before 1.4.4, and Heimdal 0.7.2 and earlier. The issue is that the (1) ftpd and (2) ksu setuid calls do not check return codes, which could allow local privilege escalation if setuid fails to drop privileges. The description notes th...

CVE-2006-3084

The 1 ftpd and 2 ksu programs in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not kno...

MITKRB-SA-2006-001: multiple local privilege escalation vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MIT krb5 Security Advisory 2006-001 Original release: 2006-08-08 Topic: multiple local privilege escalation vulnerabilities Severity: serious SUMMARY ======= In certain application programs packaged in the MIT Kerberos 5 source distribution, calls to...

security flaw

The 1 krshd and 2 v4rcp applications in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges usi...

[UNIX] Liblesstif Local Root (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

Setuid() - nproc limit the type of vulnerability of in-depth analysis-vulnerability warning-the black bar safety net

Setuid - nproc limit the type of vulnerability of in-depth analysis PST --------- Subject : Setuid - nproc limit the type of vulnerability of in-depth analysis --------- Author : [email protected] --------- Copyright : www.ph4nt0m.org www.secwiki.com --------- Date : 07/20/2006 ---------...

Mac OS X <= 10.4.7 fetchmail Privilege Escalation Exploit (x86)

Exploit for macOS platform in category local exploits =============================================================== Mac OS X kevin-finisterres-mac-mini: kfinisterre$ /usr/bin/fetchmail -p pop3 --fastuidl 1 localhost -P 1234 Enter password for email protected: sh-2.05b$ id uid=501kfinisterre...

[slackware-security] x11

New x11 packages are available for Slackware 10.2 and -current to fix security issues. In addition, fontconfig and freetype have been split out from the x11 packages in -current, so if you run -current you'll also need to install those new packages. More details about the issues may be found here...

linux/x86 setuid/portbind shellcode 96 bytes

Exploit for linux/x86 platform in category shellcode ============================================ linux/x86 setuid/portbind shellcode 96 bytes ============================================ / $Id: portbind-linux.c,v 1.4 2004/06/02 12:22:30 raptor Exp $ portbind-linux.c - setuid/portbind shellcode f...

bsd/x86 - setuid/portbind shellcode 94 bytes

bsd/x86 setuid/portbind shellcode 94 bytes. Shellcode exploit for bsdx86 platform / $Id: portbind-bsd.c,v 1.3 2004/06/02 12:22:30 raptor Exp $ portbind-bsd.c - setuid/portbind shellcode for BSD/x86 Copyright c 2003 Marco Ivaldi Simple portbind shellcode that bind's a setuid0 shell on port 31337/t...

linux/x86 setuid(0) and /bin/sh execve() shellcode 30 bytes

Exploit for linux/x86 platform in category shellcode =========================================================== linux/x86 setuid0 and /bin/sh execve shellcode 30 bytes =========================================================== / $Id: setuid-linux.c,v 1.4 2004/06/02 12:22:30 raptor Exp $...

bsd/x86 - setuid/execve shellcode 30 bytes

bsd/x86 setuid/execve shellcode 30 bytes. Shellcode exploit for bsdx86 platform / $Id: setuid-bsd.c,v 1.6 2004/06/02 12:22:30 raptor Exp $ setuid-bsd.c - setuid/execve shellcode for BSD/x86 Copyright c 2003 Marco Ivaldi Short setuid0 and /bin/sh execve shellcode based on esdee's code. Tested on...