FreeBSD-SA-00:16.golddig

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:16 Security Advisory FreeBSD, Inc. Topic: golddig port allows users to overwrite local files Category: ports Module: golddig Announced: 2000-05-09 Credits: Discovered...

Solaris 7 x86 lp exploit.

Setuid proggie /usr/bin/lp has an easily exploitable buffer overflow. This exploit is for Solaris 7 x86 version, no sparc exploit is available to my knowledge. later, DiGiT / solaris 2.7 /usr/bin/lp local exploit, i386. discovered by DiGiT. try offset 150-250 if sploit fails greets: !ADM,...

Дырка в mtr

mtr использует вызов seteuid вместо setuid чтобы освободиться от привилегий root...

Potential security problem with mtr

Hi. One of my users asked me to install mtr, most adequately described as a GUI:ed combination of traceroute and ping. I thought it looked cool, and had a closer look. In this mail follows a warning about a potential security problem with this program if installed as suggested. No exploit has bee...

freebsd libncurses overflow

b u f f e r 0 v e r f l 0 w s e c u r i t y a d v i s o r y 3 Advisory Name: libncurses buffer overflow Date: 24/4/00 Application: NCURSES 1.8.6 / FreeBSD 3.4-STABLE Vendor: FreeBSD Inc. WWW: www.freebsd.org Severity: setuid programs linked with libncurses can be exploited to obtain root access...

minor issue with IBM HTTPD and /usr/bin/ikeyman

Summary: /usr/bin/ikeyman is a shell script installed with setuid root permissions by the IBMHSSSB package on Solaris. The script does not seem to work very well in a Solaris 2.6 environment because of dynamic linker issues; if they are resolved, however, an unprivileged user may then be able to...

Дырка в gpm

при запуске пользовательского приложения из gmp-root сначала выполняется setuid и только потом setgid, который не срабатывает. В результате, пользовательское приложение запускается с gid wheel...

gpm-root

Hi! I've sent report about the following security hole to the authors of gpm, but they seemed to ignore the problem. The problem applies to every gpm version known by me, for example 1.18.1 and 1.19.0. To exploit this problem, gpm-root must be running on a machine and the user needs both login to...

Halloween Linux 4.0 SuSE Linux 6.06.16.26.3 - kreatecd Local Privilege Escalation

Halloween Linux 4.0 SuSE Linux 6.06.16.26.3 - kreatecd Local Privilege Escalation source: https://www.securityfocus.com/bid/1061/info A vulnerability exists in the kreatecd program for Linux. This program is a graphical front end to the cdrecord program, and is installed setuid root. This program...

FreeBSD-SA-00:10.orville-write

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:10 Security Advisory FreeBSD, Inc. Topic: orville-write port contains local root compromise. Category: ports Module: orville-write Announced: 2000-03-15 Affects: Ports...

Halloween Linux 4.0 RedHat Linux 6.16.2 - imwheel (2)

Halloween Linux 4.0 RedHat Linux 6.16.2 - imwheel 2 // source: https://www.securityfocus.com/bid/1060/info A vulnerability exists in the 'imwheel' package for Linux. This package is known to be vulnerable to a buffer overrun in its handling of the HOME environment variable. By supplying a...

Sam Hawker wmcdplay 1.0 beta1-2 - Local Buffer Overflow (2)

source: https://www.securityfocus.com/bid/1047/info wmcdplay is cdplayer generally used with the WindowMaker X11 window-manager on unix systems. While wmcdplay is rarely installed at all by default, when it is installed it is typically set setuid root. wmcdplay is vulnerable to a buffer overflow...

Sam Hawker wmcdplay 1.0 beta1-2 - Local Buffer Overflow (2)

Sam Hawker wmcdplay 1.0 beta1-2 - Local Buffer Overflow 2 source: https://www.securityfocus.com/bid/1047/info wmcdplay is cdplayer generally used with the WindowMaker X11 window-manager on unix systems. While wmcdplay is rarely installed at all by default, when it is installed it is typically set...

Halloween Linux 4.0 / RedHat Linux 6.1/6.2 - 'imwheel' (1)

// source: https://www.securityfocus.com/bid/1060/info A vulnerability exists in the 'imwheel' package for Linux. This package is known to be vulnerable to a buffer overrun in its handling of the HOME environment variable. By supplying a sufficiently long string containing machine executable code...

AT Computing atsar_linux 1.4 - File Manipulation

AT Computing atsarlinux 1.4 - File Manipulation source: https://www.securityfocus.com/bid/1048/info atsar is a linux load monitoring software package released under the GPL by AT Computing. atsadc is a setuid root binary that is included in the atsar package. atsadc is setuid because it obtains...

AT Computing atsar_linux 1.4 - File Manipulation

source: https://www.securityfocus.com/bid/1048/info atsar is a linux load monitoring software package released under the GPL by AT Computing. atsadc is a setuid root binary that is included in the atsar package. atsadc is setuid because it obtains informatin via /dev/kmem. atsadc will accept as a...

Matt Kimball and Roger Wolff mtr 0.280.41 Turbolinux 3.5 b24.24.46.0 - mtr (2)

Matt Kimball and Roger Wolff mtr 0.280.41 Turbolinux 3.5 b24.24.46.0 - mtr 2 // source: https://www.securityfocus.com/bid/1038/info A potential vulnerability exists in the 'mtr' program, by Matt Kimball and Roger Wolff. Versions prior to 0.42 incorrectly dropped privileges on all Unix variants...

CVE-1999-0462

suidperl in Linux Perl does not check the nosuid mount option on file systems, allowing local users to gain root access by placing a setuid script in a mountable file system, e.g. a CD-ROM or floppy disk...

CVE-1999-1382

NetWare NFS mode 1 and 2 implements the "Read Only" flag in Unix by changing the ownership of a file to root, which allows local users to gain root privileges by creating a setuid program and setting it to "Read Only," which NetWare-NFS changes to a setuid root program...

SGI IRIX 6.2 - midikeyssoundplayer Local Privilege Escalation

SGI IRIX 6.2 - midikeyssoundplayer Local Privilege Escalation !/bin/sh source: https://www.securityfocus.com/bid/909/info SGI's Irix operating system ships with an X11 application called 'soundplayer' which is used to play .WAV files. It is not setuid root by itself, but can inherit root privileg...