Debian DSA-034-1 : ePerl - remote root exploit

Fumitoshi Ukai and Denis Barbier have found several potential buffer overflow bugs in our version of ePerl as distributed in all of our distributions. When eperl is installed setuid root, it can switch to the UID/GID of the scripts owner. Although Debian doesn't ship the program setuid root, this...

Debian DSA-364-3 : man-db - buffer overflows, arbitrary command execution

man-db provides the standard man1 command on Debian systems. During configuration of this package, the administrator is asked whether man1 should run setuid to a dedicated user 'man' in order to provide a shared cache of preformatted manual pages. The default is for man1 NOT to be setuid, and in...

Debian DSA-086-1 : ssh-nonfree - remote root exploit

We have received reports that the 'SSH CRC-32 compensation attack detector vulnerability' is being actively exploited. This is the same integer type error previously corrected for OpenSSH in DSA-027-1. OpenSSH the Debian ssh package was fixed at that time, but ssh-nonfree and ssh-socks were not...

Debian DSA-310-1 : xaos - improper setuid-root execution

XaoS, a program for displaying fractal images, is installed setuid root on certain architectures in order to use svgalib, which requires access to the video hardware. However, it is not designed for secure setuid execution, and can be exploited to gain root privileges. In these updated packages,...

Debian DSA-299-1 : leksbot - improper setuid-root execution

Maurice Massar discovered that, due to a packaging error, the program /usr/bin/KATAXWR was inadvertently installed setuid root. This program was not designed to run setuid, and contained multiple vulnerabilities which could be exploited to gain root privileges. %NASLMINLEVEL 70300 C Tenable Netwo...

Debian DSA-463-1 : samba - privilege escalation

Samba, a LanManager-like file and printer server for Unix, was found to contain a vulnerability whereby a local user could use the 'smbmnt' utility, which is setuid root, to mount a file share from a remote server which contained setuid programs under the control of the user. These programs could...

CVE-2003-1052

IBM DB2 7.1 and 8.1 allow the bin user to gain root privileges by modifying the shared libraries that are used in setuid root programs...

bsd/x86 - execve /bin/sh setuid 0 29 bytes

bsd/x86 execve /bin/sh setuid 0 29 bytes. Shellcode exploit for bsdx86 platform / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 29 bytes. -setuid0; -execve/bin/sh; / char shellcode= "\x31\xc0" // xor %eax,%eax "\x50" // push %eax "\xb0\x17" // mov $0x17,%al "\x50" // push %eax...

os-x/PPC setuid(0) + execve /bin/sh 88 bytes

No description provided by source. / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does setuid0; execve/bin/sh; exit0; See ASM below. 88 Bytes. / char shellcode = "\x7c\x63\x1a\x79\x40\x82\xff\xfd" "\x7d\x68\x02\xa6\x3b\xeb\x01\x70" "\x39\x40\x01\x70\x39\x1f\xfe\xdf" "\x7c\x68\x19\xae\x38\x0a\xfe\xa7...

os-x/PPC setuid(0) + execve /bin/sh 88 bytes

Exploit for os-x/ppc platform in category shellcode ============================================ os-x/PPC setuid0 + execve /bin/sh 88 bytes ============================================ / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does setuid0; execve/bin/sh; exit0; See ASM below. 88 Bytes. / char...

freebsd/x86 kldload /tmp/o.o 74 bytes

No description provided by source. / The kldload shellcode setuid0 loads /tmp/o.o kernel module Size 74 bytes OS FreeBSD /rootteam/dev0id www.sysworld.net [email protected] BITS 32 jmp short callme main: pop esi xor eax,eax mov al,0x17 push eax int 0x80 xor eax,eax push eax push long 0x68732f...

freebsd/x86 kldload /tmp/o.o 74 bytes

Exploit for freebsd/x86 platform in category shellcode ===================================== freebsd/x86 kldload /tmp/o.o 74 bytes ===================================== / The kldload shellcode setuid0 loads /tmp/o.o kernel module Size 74 bytes OS FreeBSD /rootteam/dev0id www.sysworld.net...

os-x/PPC setuid0 + execve /bin/sh 88 bytes

os-x/PPC setuid0 + execve /bin/sh 88 bytes. Shellcode exploit for osxppc platform / PPC OSX/Darwin Shellcode by B-r00t. 2003. Does setuid0; execve/bin/sh; exit0; See ASM below. 88 Bytes. / char shellcode = "\x7c\x63\x1a\x79\x40\x82\xff\xfd" "\x7d\x68\x02\xa6\x3b\xeb\x01\x70"...

bsd/x86 execve /bin/sh setuid (0) 29 bytes

No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 29 bytes. -setuid0; -execve/bin/sh; / char shellcode= "\x31\xc0" // xor %eax,%eax "\x50" // push %eax "\xb0\x17" // mov $0x17,%al "\x50" // push %eax "\xcd\x80" // int $0x80 "\x50" // push %eax...

bsd/x86 execve /bin/sh setuid (0) 29 bytes

Exploit for bsd/x86 platform in category shellcode ========================================== bsd/x86 execve /bin/sh setuid 0 29 bytes ========================================== / BSD version FreeBSD, OpenBSD, NetBSD. email protected 29 bytes. -setuid0; -execve/bin/sh; / char shellcode= "\x31\xc0...

rsynxOSX.txt

Product: RsyncX is a frontend for rsync running on OS X, with additional features such as crontab editing. http://www.macosxlabs.org/rsyncx/rsyncx.html Problems: 1 RsyncX is installed setuid root and setgid wheel. Upon execution, the program drops root privileges only via seteuidgetuid . However ...

RsyncX vulnerabilities

Product: RsyncX is a frontend for rsync running on OS X, with additional features such as crontab editing. http://www.macosxlabs.org/rsyncx/rsyncx.html Problems: 1 RsyncX is installed setuid root and setgid wheel. Upon execution, the program drops root privileges only via seteuidgetuid . However ...

MacOSXLabs RsyncX 2.1 - Local Privilege Escalation

MacOSXLabs RsyncX 2.1 - Local Privilege Escalation source: https://www.securityfocus.com/bid/11211/info It is reported that RsyncX is prone to a local privilege escalation vulnerability. RsyncX is installed setuid root and setgid wheel. It is reported that RsyncX drops root privileges properly bu...

CVE-2004-0806

CVE-2004-0806 affects cdrecord in the cdrtools package prior to 2.01, where cdrecord, when installed setuid root, fails to drop privileges before invoking a program specified by the RSH environment variable, enabling a local user to gain privileges. The issue is addressed in cdrtools 2.01 (upstre...

QNX Photon phlocale - -s Overflow

QNX Photon phlocale - -s Overflow source: https://www.securityfocus.com/bid/11164/info Reportedly QNX Photon MicroGUI is affected by multiple buffer overflow vulnerabilities in MicroGUI utilities. These issues are due to a failure of the affected applications to validate user-supplied string...